# raw_template_files

created_at: 2025-12-04 18:14:14.136245
files:
  {"file:///root/tripleo-heat-installer-templates/config-download-structured.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"name\": {\"type\": \"string\", \"default\": \"\"}, \"actions\": {\"type\": \"comma_delimited_list\", \"default\": [\"CREATE\", \"UPDATE\"]}, \"server\": {\"type\": \"string\"}, \"config\": {\"type\": \"string\"}, \"input_values\": {\"type\": \"json\", \"description\": \"input values for the software deployments\", \"default\": {}}, \"input_key\": {\"type\": \"string\", \"default\": \"get_input\"}, \"signal_transport\": {\"type\": \"string\", \"default\": \"CFN_SIGNAL\"}, \"input_values_validate\": {\"type\": \"string\", \"default\": \"LAX\"}}, \"resources\": {\"TripleODeployment\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"name\": {\"get_param\": \"name\"}, \"server\": {\"get_param\": \"server\"}, \"config\": {\"get_param\": \"config\"}, \"input_values\": {\"get_param\": \"input_values\"}, \"deployment\": {\"get_resource\": \"TripleOSoftwareDeployment\"}}}}, \"TripleOSoftwareDeployment\": {\"type\": \"OS::Heat::StructuredDeployment\", \"properties\": {\"name\": \"deployment_resource\", \"config\": {\"get_param\": \"config\"}, \"server\": \"fake_server_id\", \"input_values\": {\"get_param\": \"input_values\"}, \"signal_transport\": \"NO_SIGNAL\", \"actions\": {\"get_param\": \"actions\"}}}}, \"outputs\": {\"deploy_status_code\": {\"value\": 0}, \"deploy_stderr\": {\"value\": \"\"}, \"deploy_stdout\": {\"value\": \"\"}, \"show\": {\"value\": \"\"}, \"update_managed_packages\": {\"description\": \"boolean value indicating whether to upgrade managed packages\", \"value\": false}, \"hostname\": {\"description\": \"hostname\", \"value\": \"\"}}}", "file:///root/tripleo-heat-installer-templates/config-download-software.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"name\": {\"type\": \"string\", \"default\": \"\"}, \"actions\": {\"type\": \"comma_delimited_list\", \"default\": [\"CREATE\", \"UPDATE\"]}, \"server\": {\"type\": \"string\"}, \"config\": {\"type\": \"string\"}, \"input_values\": {\"type\": \"json\", \"description\": \"input values for the software deployments\", \"default\": {}}, \"input_key\": {\"type\": \"string\", \"default\": \"get_input\"}, \"signal_transport\": {\"type\": \"string\", \"default\": \"CFN_SIGNAL\"}, \"input_values_validate\": {\"type\": \"string\", \"default\": \"LAX\"}}, \"resources\": {\"TripleODeployment\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"name\": {\"get_param\": \"name\"}, \"server\": {\"get_param\": \"server\"}, \"config\": {\"get_param\": \"config\"}, \"input_values\": {\"get_param\": \"input_values\"}, \"deployment\": {\"get_resource\": \"TripleOSoftwareDeployment\"}}}}, \"TripleOSoftwareDeployment\": {\"type\": \"OS::Heat::SoftwareDeployment\", \"properties\": {\"name\": \"deployment_resource\", \"config\": {\"get_param\": \"config\"}, \"server\": \"fake_server_id\", \"input_values\": {\"get_param\": \"input_values\"}, \"signal_transport\": \"NO_SIGNAL\", \"actions\": {\"get_param\": \"actions\"}}}}, \"outputs\": {\"deploy_status_code\": {\"value\": 0}, \"deploy_stderr\": {\"value\": \"\"}, \"deploy_stdout\": {\"value\": \"\"}, \"show\": {\"value\": \"\"}, \"update_managed_packages\": {\"description\": \"boolean value indicating whether to upgrade managed packages\", \"value\": false}, \"hostname\": {\"description\": \"hostname\", \"value\": \"\"}}}", "file:///root/tripleo-heat-installer-templates/common/deploy-steps-playbooks-common.yaml": "---\n# If a new play with potential facts gathering is added, make sure we set:\n# any_errors_fatal: false\n# ignore_unreachable: true\n# So we don't break the MaxFailPercentage feature since these plays can't use\n# Ansible strategies.\n\n- hosts: localhost\n  name: Check if required variables are defined\n  tasks:\n    - ansible.builtin.fail:\n        msg: deploy_source_host variable is not defined\n      when: deploy_source_host is not defined\n    - ansible.builtin.fail:\n        msg: deploy_target_host variable is not defined\n      when: deploy_target_host is not defined\n    # Keep in mind that you will still need to use defaults in order to be\n    # able to pass Ansible own syntax check for blocks like 'hosts'.\n\n- hosts: all\n  name: Clear cached facts\n  # We don't want to gather facts, just clear them\n  gather_facts: false\n  tasks:\n    - ansible.builtin.meta: clear_facts\n  tags:\n    - facts\n\n- hosts: \"{{ deploy_source_host | default([]) }}:{{ deploy_target_host | default([]) }}\"\n  name: Gather facts\n  strategy: tripleo_free\n  gather_facts: true\n  tasks:\n    - name: Set legacy facts\n      ansible.builtin.set_fact:\n        ansible_distribution: \"{{ ansible_facts['distribution'] }}\"\n        ansible_distribution_major_version: \"{{ ansible_facts['distribution_major_version'] }}\"\n        ansible_distribution_release: \"{{ ansible_facts['distribution_release'] }}\"\n        ansible_distribution_version: \"{{ ansible_facts['distribution_version'] }}\"\n        ansible_os_family: \"{{ ansible_facts['os_family'] }}\"\n  tags:\n    - facts\n\n- hosts: all\n  name: Load global variables\n  gather_facts: \"{{ gather_facts | default(false) }}\"\n  any_errors_fatal: false\n  ignore_unreachable: true\n  tasks:\n    - ansible.builtin.include_vars: global_vars.yaml  # noqa: missing-import\n      no_log: true\n  tags:\n    - always\n\n- hosts: all\n  name: Include extra variables from files\n  gather_facts: \"{{ gather_facts | default(false) }}\"\n  any_errors_fatal: false\n  ignore_unreachable: true\n  tasks:\n    - name: Include Service VIP vars\n      ansible.builtin.include_vars:\n        file: \"{{ playbook_dir }}/service_vip_vars.yaml\"\n        name: service_vip_vars\n      ignore_errors: yes\n    - name: Include OVN bridge MAC address variables\n      ansible.builtin.include_vars:\n        file: \"{{ playbook_dir }}/ovn_bridge_mac_address_vars.yaml\"\n        name: ovn_bridge_mac_address_vars\n      ignore_errors: yes\n  tags:\n    - always\n\n- hosts: \"{{ deploy_target_host | default([]) }}\"\n  name: Render all_nodes data as group_vars for overcloud\n  gather_facts: \"{{ gather_facts | default(false) }}\"\n  # we don't skip errors or ignore unreachable on this one because it's\n  # delegated to localhost. localhost should never be unreachable (tm)\n  any_errors_fatal: True\n  tasks:\n    - name: Render all_nodes data as group_vars for overcloud\n      delegate_to: localhost\n      become: false\n      run_once: true\n      tripleo_all_nodes_data:\n  tags:\n    - facts\n    - always\n\n- hosts: \"{{ deploy_target_host | default([]) }}\"\n  name: Set all_nodes data as group_vars for overcloud\n  gather_facts: \"{{ gather_facts | default(false) }}\"\n  any_errors_fatal: false\n  ignore_unreachable: true\n  tasks:\n    - name: Set all_nodes data as group_vars for overcloud\n      ansible.builtin.include_vars: \"{{ playbook_dir }}/group_vars/overcloud.json\"\n      no_log: true\n  tags:\n    - facts\n    - always\n", "file:///root/tripleo-heat-installer-templates/common/deploy-steps-tasks.yaml": "#####################################################\n# Per step puppet configuration of the baremetal host\n#####################################################\n\n- name: Write the config_step hieradata\n  become: true\n  no_log: True\n  copy:\n    content: \"{{ dict(step=step|int) | to_json }}\"\n    dest: /etc/puppet/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}hieradata/config_step.json\n    force: true\n    mode: '0600'\n  check_mode: no\n  tags:\n    - host_config\n\n- name: Run puppet host configuration for step {{ step }}\n  become: true\n  async: 3600\n  poll: 0\n  when: enable_puppet|bool\n  shell: >-\n    set -o pipefail;\n    puppet apply {{ host_puppet_config_debug | default('') }}\n    --modulepath=/etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules\n    --detailed-exitcodes\n    --summarize\n    --color=false\n    {{ ansible_check_mode | bool | ternary('--noop', '') }}\n    {{ ansible_check_mode | bool | ternary('--hiera_config /etc/puppet/check-mode/hiera.yaml', '') }}\n    /var/lib/tripleo-config/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}puppet_step_config.pp\n    2>&1 | logger -s -t puppet-user\n  register: puppet_host_async_result\n  no_log: true\n  tags:\n    - host_config\n  check_mode: no\n\n- name: Wait for puppet host configuration to finish\n  async_status:\n    jid: \"{{ puppet_host_async_result.ansible_job_id }}\"\n  register: puppet_host_outputs\n  until: puppet_host_outputs.finished\n  retries: 360\n  delay: 10\n  failed_when:\n    - (not puppet_host_outputs.finished) or (puppet_host_outputs.rc is defined and puppet_host_outputs.rc not in [0, 2])\n  when:\n    - not (ansible_check_mode | bool)\n    - enable_puppet|bool\n  tags:\n    - host_config\n\n- name: \"Debug output for task: Run puppet host configuration for step {{ step }}\"\n  debug:\n    var: puppet_host_outputs.stdout_lines | default([]) | union(puppet_host_outputs.stderr_lines | default([]))\n  when:\n    - not ansible_check_mode|bool\n    - enable_puppet | bool\n    - puppet_host_outputs.rc is defined\n  changed_when: puppet_host_outputs.rc == 2\n  failed_when: puppet_host_outputs.rc not in [0, 2]\n  tags:\n    - host_config\n\n#######################################\n# Pre-cache facts for puppet containers\n#######################################\n# We don't want the pre-cache tasks to be skipped in dry-run so we force\n# check_mode to \"no\".\n# https://bugzilla.redhat.com/show_bug.cgi?id=1738529\n- name: Pre-cache facts for puppet containers\n  include_role:\n    name: tripleo_puppet_cache\n  tags:\n    - container_config\n    - container_config_tasks\n\n#######################################\n# Generate config via puppet containers\n#######################################\n\n- name: Include container-puppet tasks (generate config) during step 1\n  include_tasks: generate-config-tasks.yaml\n  when: step|int == 1\n  tags:\n    - container_config\n\n#####################################\n# Per step starting of the containers\n#####################################\n\n- name: Per step starting of the containers using tripleo-ansible\n  become: true\n  environment:\n    TRIPLEO_MINOR_UPDATE: '{{ tripleo_minor_update | default(false) }}'\n  block:\n    - name: \"Manage containers for step {{ step }} with tripleo-ansible\"\n      include_role:\n        name: tripleo_container_manage\n      vars:\n        tripleo_container_manage_concurrency: 5\n        tripleo_container_manage_systemd_order: true\n        tripleo_container_manage_cli: \"{{ container_cli }}\"\n        tripleo_container_manage_config: \"/var/lib/tripleo-config/container-startup-config/step_{{ step }}\"\n        tripleo_container_manage_config_id: \"tripleo_step{{ step }}\"\n        tripleo_container_manage_debug: \"{{ enable_debug | bool }}\"\n        tripleo_container_manage_healthcheck_disabled: \"{{ container_healthcheck_disabled | bool }}\"\n        tripleo_container_manage_log_path: \"{{ container_log_stdout_path }}\"\n        tripleo_container_manage_config_patterns: '*.json'\n        tripleo_container_manage_check_puppet_config: true\n        tripleo_container_manage_valid_exit_code: [0]\n      tags:\n        - container_startup_configs\n\n########################################################\n# Bootstrap tasks - run any tasks that have been defined\n########################################################\n\n- name: \"Clean container_puppet_tasks for {{ansible_facts['hostname'] | lower}} step {{step}}\"\n  become: true\n  file:\n    path: /var/lib/container-puppet/container-puppet-tasks{{step}}.json\n    state: absent\n  tags:\n    - container_config_tasks\n\n- name: Calculate container_puppet_tasks for {{ansible_facts['hostname'] | lower}} step {{step}}\n  set_fact:\n    \"{{'host_container_puppet_tasks_' ~ step}}\": \"{{lookup('vars', 'host_container_puppet_tasks_' ~ step, default=[]) | union([item])}}\"\n  loop: \"{{container_puppet_tasks.get('step_' ~ step, [])}}\"\n  when: (groups[item.service_name] | default ([]) | map('extract', hostvars, 'inventory_hostname') | sort | first | lower) == ansible_facts['hostname'] | lower\n  vars:\n    container_puppet_tasks: \"{{ lookup('file', tripleo_role_name + '/container_puppet_tasks.yaml', errors='ignore') | default({}, True) | from_yaml }}\"\n  tags:\n    - container_config_tasks\n\n- name: Include container-puppet tasks for step {{step}}\n  include_tasks: host-container-puppet-tasks.yaml\n  when: ('host_container_puppet_tasks_' ~ step)  is defined\n  tags:\n    - container_config_tasks\n", "file:///root/tripleo-heat-installer-templates/common/common-container-config-scripts.yaml": "- name: Create fcontext entry for container-config-scripts\n  community.general.sefcontext:\n    target: \"/var/lib/container-config-scripts(/.*)?\"\n    setype: container_file_t\n    state: present\n  tags:\n    - container_config_scripts\n\n- name: Create /var/lib/container-config-scripts\n  become: true\n  file:\n    path: /var/lib/container-config-scripts\n    state: directory\n    setype: container_file_t\n  tags:\n    - container_config_scripts\n\n- name: Write container config scripts\n  become: true\n  no_log: True\n  tripleo_container_config_scripts:\n    config_data: \"{{ lookup('file', tripleo_role_name + '/container_config_scripts.yaml', errors='ignore') | default({}, True) | from_yaml }}\"\n    config_dir: /var/lib/container-config-scripts\n  tags:\n    - container_config_scripts\n", "file:///root/tripleo-heat-installer-templates/common/hiera-steps-tasks.yaml": "- name: Hiera config\n  include_role:\n    name: tripleo_hieradata\n- name: Hiera symlink\n  become: true\n  file:\n    src: /etc/puppet/hiera.yaml\n    dest: /etc/hiera.yaml\n    state: link\n    force: true\n- name: Hieradata from vars\n  include_role:\n    name: tripleo_hieradata\n    tasks_from: hieradata_vars.yaml\n  vars:\n    hieradata_templates_list:\n      - bootstrap_node\n      - all_nodes\n      - vip_data\n      - net_ip_map\n      - cloud_domain\n      - fqdn\n      - service_names\n      - service_configs\n      - extraconfig\n      - role_extraconfig\n      - ovn_chassis_mac_map\n- name: Ensure ansible_managed hieradata file exists\n  include_role:\n    name: tripleo_hieradata\n    tasks_from: ansible_hieradata.yml\n", "file:///root/tripleo-heat-installer-templates/common/deploy-steps-tasks-step-0.yaml": "- name: Deploy step tasks for step 0\n  delegate_to: localhost\n  run_once: true\n  debug:\n    msg: Use --start-at-task 'Deploy step tasks for step 0' to resume from this task\n  when: \"tripleo_minor_update is not defined or tripleo_minor_update != 'true'\"\n- name: Ensure /var/log/journal exists\n  become: true\n  file: path=/var/log/journal state=directory mode=0750 owner=root group=root setype=var_log_t\n- name: Check cloud-init status\n  shell: systemctl is-active cloud-init.service || systemctl is-enabled cloud-init.service\n  failed_when: false\n  become: true\n  register: cloud_init_enabled\n- name: Check if cloud-init is disabled via kernel args\n  shell: cat /proc/cmdline | grep -q cloud-init=disabled\n  failed_when: false\n  check_mode: false\n  register: cloud_init_vendor_disabled\n- name: Wait for cloud-init to finish, if enabled\n  community.general.cloud_init_data_facts:\n    filter: status\n  register: res\n  until: >\n    res.cloud_init_data_facts.status.v1.stage is defined and\n    not res.cloud_init_data_facts.status.v1.stage\n  retries: 50\n  delay: 5\n  when:\n    - cloud_init_enabled.rc is defined\n    - cloud_init_enabled.rc == 0\n    - cloud_init_vendor_disabled.rc is not defined or cloud_init_vendor_disabled.rc != 0\n- name: Create /var/lib/container-puppet\n  become: true\n  no_log: True\n  file: path=/var/lib/container-puppet state=directory setype=container_file_t selevel=s0 recurse=true\n- name: Write container-puppet.sh\n  become: true\n  no_log: True\n  copy: src=container_puppet_script.yaml dest=/var/lib/container-puppet/container-puppet.sh force=yes mode=0755 setype=container_file_t\n- include_tasks: \"{{ _task_file_path }}\"\n  vars:\n    _task_file_path: \"{{ tripleo_role_name }}/deploy_steps_tasks_step0.yaml\"\n  when: \"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\"", "file:///root/tripleo-heat-installer-templates/common/common-container-setup-tasks.yaml": "- name: Create and ensure setype for /var/log/containers directory\n  become: true\n  file:\n    path: /var/log/containers\n    state: directory\n    setype: container_file_t\n    selevel: s0\n    mode: 0750\n  tags:\n    - host_config\n\n- name: Create ContainerLogStdoutPath directory\n  become: true\n  file:\n    path: \"{{ container_log_stdout_path }}\"\n    state: directory\n    selevel: s0\n  tags:\n    - host_config\n\n- name: Create /var/lib/tripleo-config directory\n  become: true\n  file:\n    path: /var/lib/tripleo-config\n    state: directory\n    setype: container_file_t\n    selevel: s0\n    recurse: true\n  tags:\n    - host_config\n    - container_config\n    - container_config_tasks\n    - container_config_scripts\n    - container_startup_configs\n\n# The container config files\n# /var/lib/container-startup-configs.json is removed as we now write\n# per-step files instead\n- name: Clean old /var/lib/container-startup-configs.json file\n  become: true\n  file:\n    path: /var/lib/container-startup-configs.json\n    state: absent\n  tags:\n    - container_startup_configs\n\n# For legacy, can be removed in Train cycle\n- name: Clean old /var/lib/docker-container-startup-configs.json file\n  become: true\n  file:\n    path: /var/lib/docker-container-startup-configs.json\n    state: absent\n  tags:\n    - container_startup_configs\n\n- import_tasks: common_container_config_scripts.yaml\n\n# This file location is deprecated and the new location is now:\n# /var/lib/tripleo-config/container-startup-config/step_X/<container_name>.json\n# Can be removed in V cycle\n- name: Write /var/lib/tripleo-config/container-startup-config-readme.txt\n  become: true\n  no_log: True\n  copy:\n    content: \"Container startup configs moved to /var/lib/tripleo-config/container-startup-config\"\n    dest: /var/lib/tripleo-config/container-startup-config-readme.txt\n    force: yes\n    mode: '0600'\n  tags:\n    - container_startup_configs\n\n- name: Generate startup configs files per step and per container\n  become: true\n  container_startup_config:\n    config_base_dir: /var/lib/tripleo-config/container-startup-config\n    config_data: \"{{ lookup('template', (tripleo_role_name + '/docker_config.yaml'), errors='ignore') | default({}, True) | from_yaml }}\"\n  tags:\n    - container_startup_configs\n\n- name: Create /var/lib/kolla/config_files directory\n  become: true\n  file:\n    path: /var/lib/kolla/config_files\n    state: directory\n    setype: container_file_t\n    selevel: s0\n    recurse: true\n  tags:\n    - container_startup_configs\n\n- name: Create /var/lib/config-data directory\n  become: true\n  file:\n    path: /var/lib/config-data\n    mode: 0755\n    state: directory\n    setype: container_file_t\n    selevel: s0\n\n- name: Write container config json files\n  become: true\n  tripleo_container_configs:\n    config_data: \"{{ lookup('file', tripleo_role_name + '/kolla_config.yaml', errors='ignore') | default({}, True) | from_yaml }}\"\n  tags:\n    - container_startup_configs\n", "file:///root/tripleo-heat-installer-templates/common/deploy-steps-tasks-step-1.yaml": "- name: Delete existing /var/lib/tripleo-config/check-mode directory for check mode\n  become: true\n  file:\n    path: /var/lib/tripleo-config/check-mode\n    state: absent\n  tags:\n    - host_config\n    - container_config\n    - container_config_tasks\n    - container_config_scripts\n    - container_startup_configs\n  when:\n    - ansible_check_mode|bool\n  check_mode: no\n\n- name: Create /var/lib/tripleo-config/check-mode directory for check mode\n  become: true\n  file:\n    path: /var/lib/tripleo-config/check-mode\n    state: directory\n    setype: container_file_t\n    selevel: s0\n    recurse: true\n  tags:\n    - host_config\n    - container_config\n    - container_config_tasks\n    - container_config_scripts\n    - container_startup_configs\n  when:\n    - ansible_check_mode|bool\n  check_mode: no\n\n# Puppet manifest for baremetal host configuration\n- name: Write the puppet step_config manifest\n  become: true\n  no_log: True\n  copy:\n    content: \"{{ lookup('file', tripleo_role_name + '/step_config.pp', errors='ignore') | default('', True) }}\"\n    dest: /var/lib/tripleo-config/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}puppet_step_config.pp\n    force: yes\n    mode: '0600'\n  tags:\n    - host_config\n  check_mode: no\n  diff: no\n\n- name: Diff puppet step_config manifest changes for check mode\n  command:\n    diff -uN /var/lib/tripleo-config/puppet_step_config.pp /var/lib/tripleo-config/check-mode/puppet_step_config.pp\n  register: diff_results\n  tags:\n    - host_config\n  check_mode: no\n  when:\n    - ansible_check_mode|bool\n    - ansible_diff_mode\n  failed_when: false\n  changed_when: diff_results.rc == 1\n\n- name: Diff puppet step_config manifest changes for check mode\n  debug:\n    var: diff_results.stdout_lines\n  changed_when: diff_results.rc == 1\n  when:\n    - ansible_check_mode|bool\n    - ansible_diff_mode\n  tags:\n    - host_config\n\n# Puppet Containers Config directory used to generate container configs\n- name: Create /var/lib/container-puppet\n  become: true\n  file:\n    path: /var/lib/container-puppet\n    state: directory\n    setype: container_file_t\n    selevel: s0\n  tags:\n    - container_config\n    - container_config_tasks\n\n- name: Delete existing /var/lib/container-puppet/check-mode for check mode\n  become: true\n  file:\n    path: /var/lib/container-puppet/check-mode\n    state: absent\n  tags:\n    - container_config\n  check_mode: no\n  when:\n    - ansible_check_mode|bool\n\n- name: Create /var/lib/container-puppet/check-mode for check mode\n  become: true\n  file:\n    path: /var/lib/container-puppet/check-mode\n    state: directory\n    setype: container_file_t\n    selevel: s0\n  tags:\n    - container_config\n  check_mode: no\n  when:\n    - ansible_check_mode|bool\n\n- name: Write container-puppet.json file\n  become: true\n  no_log: True\n  copy:\n    content: \"{{ lookup('template', tripleo_role_name + '/puppet_config.yaml', errors='ignore') | default([], True) | from_yaml | to_nice_json }}\"\n    dest: /var/lib/container-puppet/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}container-puppet.json\n    force: yes\n    mode: '0600'\n  tags:\n    - container_config\n  check_mode: no\n  diff: no\n\n- name: Diff container-puppet.json changes for check mode\n  command:\n    diff -uN /var/lib/container-puppet/container-puppet.json /var/lib/container-puppet/check-mode/container-puppet.json\n  register: diff_results\n  tags:\n    - container_config\n  check_mode: no\n  when:\n    - ansible_check_mode|bool\n    - ansible_diff_mode\n  failed_when: false\n  changed_when: diff_results.rc == 1\n\n- name: Diff container-puppet.json changes for check mode\n  debug:\n    var: diff_results.stdout_lines\n  changed_when: diff_results.rc == 1\n  when:\n    - ansible_check_mode|bool\n    - ansible_diff_mode\n  tags:\n    - container_config\n\n- name: Ensure config hashes are up-to-date for container startup configs\n  become: true\n  container_puppet_config:\n    update_config_hash_only: true\n  tags:\n    - container_startup_configs\n\n- name: Set host puppet debugging fact string\n  set_fact:\n    host_puppet_config_debug: \"--debug --verbose\"\n  when:\n    - enable_puppet | bool\n    - enable_debug | bool\n  tags:\n    - host_config\n\n- name: Check for /etc/puppet/check-mode directory for check mode\n  stat:\n    path: /etc/puppet/check-mode\n  register: check_mode_dir\n  when: ansible_check_mode|bool\n  tags:\n    - host_config\n    - container_config\n\n- name: Create /etc/puppet/check-mode/hieradata directory for check mode\n  become: true\n  file:\n    path: /etc/puppet/check-mode/hieradata\n    state: directory\n    setype: container_file_t\n    selevel: s0\n    recurse: true\n  check_mode: no\n  when:\n    - ansible_check_mode|bool\n    - not check_mode_dir.stat.exists\n  tags:\n    - host_config\n    - container_config\n\n- name: Create puppet check-mode files if they don't exist for check mode\n  become: true\n  shell: |\n    cp -a /etc/puppet/hiera.yaml /etc/puppet/check-mode/hiera.yaml\n    cp -a /etc/puppet/hieradata/* /etc/puppet/check-mode/hieradata/\n    sed -i 's/\\/etc\\/puppet\\/hieradata/\\/etc\\/puppet\\/check-mode\\/hieradata/' /etc/puppet/check-mode/hiera.yaml\n  when:\n    - ansible_check_mode|bool\n    - not check_mode_dir.stat.exists\n  check_mode: no\n  tags:\n    - host_config\n    - container_config\n", "file:///root/tripleo-heat-installer-templates/common/container-puppet.sh": "#!/bin/bash\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n\nset -e\n[ \"$DEBUG\" = \"false\" ] || set -x\nrm -rf /etc/puppet\nmkdir -p /etc/puppet\ncp -dR /tmp/puppet-etc/* /etc/puppet\nrm -Rf /etc/puppet/ssl # not in use and causes permission errors\necho \"{\\\"step\\\": $STEP}\" > /etc/puppet/hieradata/docker_puppet.json\nTAGS=\"\"\nif [ -n \"$PUPPET_TAGS\" ]; then\n    TAGS=\"--tags \\\"$PUPPET_TAGS\\\"\"\nfi\n\nif [ ! -z ${STEP_CONFIG+x} ]; then\n    echo -e \"${STEP_CONFIG}\" | tee /etc/config.pp\nfi\n\nCHECK_MODE=\"\"\nif [ -d \"/tmp/puppet-check-mode\" ]; then\n    mkdir -p /etc/puppet/check-mode\n    cp -a /tmp/puppet-check-mode/* /etc/puppet/check-mode\n    CHECK_MODE=\"--hiera_config /etc/puppet/check-mode/hiera.yaml\"\nfi\n\n# Create a reference timestamp to easily find all files touched by\n# puppet. The sync ensures we get all the files we want due to\n# different timestamp.\nconf_data_path=\"/var/lib/config-data/${NAME}\"\norigin_of_time=\"${conf_data_path}.origin_of_time\"\ntouch $origin_of_time\nsync\n\nexport NET_HOST=\"${NET_HOST:-false}\"\nset +e\nif [ \"$NET_HOST\" == \"false\" ]; then\n    export FACTER_hostname=$HOSTNAME\nfi\n# $::deployment_type in puppet-tripleo\nexport FACTER_deployment_type=containers\nexport FACTER_uuid=$(cat /sys/class/dmi/id/product_uuid | tr '[:upper:]' '[:lower:]')\necho 'Running puppet'\n# FIXME(bogdando): stdout may be falling behind of the logged syslog messages\nset -x\n/usr/bin/puppet apply --summarize \\\n                      --detailed-exitcodes \\\n                      --color=false \\\n                      --modulepath=/etc/puppet/modules:/usr/share/openstack-puppet/modules \\\n                      $TAGS \\\n                      $CHECK_MODE \\\n                      /etc/config.pp \\\n                      2>&1 | logger -s -t puppet-user\nrc=${PIPESTATUS[0]}\n[ \"$DEBUG\" = \"false\" ] && set +x\nset -e\nif [ $rc -ne 2 -a $rc -ne 0 ]; then\n    exit $rc\nfi\n\nverbosity=\"\"\n[ \"$DEBUG\" = \"false\" ] || verbosity=\"-v\"\n\n# Disables archiving\nif [ -z \"$NO_ARCHIVE\" ]; then\n    archivedirs=(\"/etc\" \"/root\" \"/opt\" \"/var/www\" \"/var/spool/cron\" \"/var/lib/nova/.ssh\")\n    rsync_srcs=\"\"\n    for d in \"${archivedirs[@]}\"; do\n        if [ -d \"$d\" ]; then\n            rsync_srcs+=\" $d\"\n        fi\n    done\n    # On stack update, if a password was changed in a config file,\n    # some services (e.g. mysql) must change their internal state\n    # (e.g. password in mysql DB) when tripleo_container_manage restarts them;\n    # and they need the old password to achieve that.\n    # For those services, we update the config hash to notify\n    # tripleo_container_manage that a restart is needed, but we do not update\n    # the password file in container-puppet if the file already existed\n    # before and let the service regenerate it instead.\n    password_files=\"/root/.my.cnf\"\n\n    exclude_files=\"\"\n    for p in $password_files; do\n        if [ -f \"$p\" -a -f \"${conf_data_path}$p\" ]; then\n            exclude_files+=\" --exclude=$p\"\n        fi\n    done\n\n    # Exclude read-only mounted directories/files which we do not want\n    # to copy or delete.\n    ro_files=\"/etc/puppet/ /etc/puppetlabs/ /opt/puppetlabs/ /etc/pki/ca-trust/extracted \"\n    ro_files+=\"/etc/pki/ca-trust/source/anchors /etc/pki/tls/certs/ca-bundle.crt \"\n    ro_files+=\"/etc/pki/tls/certs/ca-bundle.trust.crt /etc/pki/tls/cert.pem \"\n    ro_files+=\"/etc/hosts /etc/localtime /etc/hostname \"\n    # /etc/openldap is bind mounted with \"ro\" option in keystone containers.\n    ro_files+=\"/etc/openldap\"\n    for ro in $ro_files; do\n        if [ -e \"$ro\" ]; then\n            exclude_files+=\" --exclude=$ro\"\n        fi\n    done\n\n    echo \"Evaluating config files to be removed for the $NAME configuration\"\n    TMPFILE=$(mktemp /tmp/tmp.XXXXXXXXXX)\n    TMPFILE2=$(mktemp /tmp/tmp.XXXXXXXXXX)\n    trap 'rm -rf $TMPFILE $TMPFILE2' EXIT INT HUP\n    rsync -av -R --dry-run --delete-after $exclude_files $rsync_srcs ${conf_data_path} |\\\n        awk '/^deleting/ {print $2}' > $TMPFILE\n\n    echo \"Rsyncing config files from ${rsync_srcs} into ${conf_data_path}\"\n    rsync -a $verbosity -R --delay-updates --delete-after $exclude_files $rsync_srcs ${conf_data_path}\n\n    # Also make a copy of files modified during puppet run\n    echo \"Gathering files modified after $(stat -c '%y' $origin_of_time)\"\n\n    # Purge obsoleted contents to maintain a fresh and filtered mirror\n    puppet_generated_path=/var/lib/config-data/puppet-generated/${NAME}\n    mkdir -p ${puppet_generated_path}\n    echo \"Ensuring the removed config files are also purged in ${puppet_generated_path}:\"\n    cat $TMPFILE | sort\n    cat $TMPFILE | xargs -n1 -r -I{} \\\n        bash -c \"rm -rf ${puppet_generated_path}/{}\"\n    exec 5>&1\n    exec 1>$TMPFILE2\n    find $rsync_srcs -newer $origin_of_time -not -path '/etc/puppet*' -print0\n    exec 1>&5\n    echo \"Files modified during puppet run:\"\n    cat $TMPFILE2 | xargs -0 printf \"%s\\n\" | sort -h\n    echo \"Rsyncing the modified files into ${puppet_generated_path}\"\n    rsync -a $verbosity -R -0 --delay-updates --delete-after $exclude_files \\\n        --files-from=$TMPFILE2 / ${puppet_generated_path}\n\n    # Cleanup any special files that might have been copied into place\n    # previously because fixes for LP#1860607 did not cleanup and required\n    # manual intervention if a container hit this. We can safely remove these\n    # files because they should be bind mounted into containers\n    for ro in $ro_files; do\n        if [ -e \"${puppet_generated_path}/${ro}\" ]; then\n            rm -rf \"${puppet_generated_path}/${ro}\"\n        fi\n    done\n\n    # Write a checksum of the config-data dir, this is used as a\n    # salt to trigger container restart when the config changes\n    # note: while being excluded from the output, password files\n    # are still included in checksum computation\n    additional_checksum_files=\"\"\n    excluded_original_passwords=\"\"\n    for p in $password_files; do\n        if [ -f \"$p\" ]; then\n            additional_checksum_files+=\" $p\"\n            excluded_original_passwords+=\" --exclude=/var/lib/config-data/*${p}\"\n        fi\n    done\n    # We need to exclude the swift rings and backups as those change over time\n    # and containers do not need to restart if they change\n    EXCLUDE=--exclude='*/etc/swift/backups/*'\\ --exclude='*/etc/swift/*.ring.gz'\\ --exclude='*/etc/swift/*.builder'\\ --exclude='*/etc/libvirt/passwd.db'\\ ${excluded_original_passwords}\n\n    # We need to repipe the tar command through 'tar xO' to force text\n    # output because otherwise the sed command cannot work. The sed is\n    # needed because puppet puts timestamps as comments in cron and\n    # parsedfile resources, hence triggering a change at every redeploy\n    tar -c --mtime='1970-01-01' $EXCLUDE -f - ${conf_data_path} $additional_checksum_files | tar xO | \\\n            sed '/^#.*HEADER.*/d; s/\\#.HEADER.*//g' | md5sum | awk '{print $1}' > ${conf_data_path}.md5sum\n    tar -c --mtime='1970-01-01' $EXCLUDE -f - ${puppet_generated_path} $additional_checksum_files --mtime='1970-01-01' | tar xO \\\n            | sed '/^#.*HEADER.*/d; s/\\#.HEADER.*//g' | md5sum | awk '{print $1}' > ${puppet_generated_path}.md5sum\nfi\n", "file:///root/tripleo-heat-installer-templates/common/generate-config-tasks.yaml": "- name: Block for container-puppet tasks (generate config) during step {{ step }} with tripleo-ansible\n  become: true\n  tags:\n    - container_config\n  block:\n    - name: Create base directory puppet configs\n      file:\n        path: \"/var/lib/tripleo-config/container-puppet-config\"\n        mode: 0700\n        recurse: true\n        setype: container_file_t\n\n    - name: \"Generate container puppet configs for step {{ step }}\"\n      container_puppet_config:\n        check_mode: '{{ ansible_check_mode | bool | ternary(1, 0) }}'\n        config_vol_prefix: \"/var/lib/config-data{{ ansible_check_mode | bool | ternary('/check-mode', '') }}\"\n        debug: \"{{ docker_puppet_debug | bool }}\"\n        net_host: true\n        no_archive: false\n        puppet_config: \"/var/lib/container-puppet/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}container-puppet.json\"\n        short_hostname: \"{{ ansible_facts['hostname'] | lower }}\"\n        step: \"{{ step }}\"\n\n    - name: \"Manage Puppet containers (generate config) for step {{ step }} with tripleo-ansible\"\n      include_role:\n        name: tripleo_container_manage\n      vars:\n        tripleo_container_manage_concurrency: \"{{ docker_puppet_process_count }}\"\n        tripleo_container_manage_systemd_order: false\n        tripleo_container_manage_systemd_teardown: false\n        tripleo_container_manage_config: \"/var/lib/tripleo-config/container-puppet-config/step_{{ step }}\"\n        tripleo_container_manage_config_patterns: 'container-puppet-*.json'\n        tripleo_container_manage_config_id: \"tripleo_puppet_step{{ step }}\"\n        tripleo_container_manage_debug: \"{{ docker_puppet_debug | bool }}\"\n        # puppet with --detailed-exitcodes will return 0 for success and\n        # no changes and 2 for success and resource changes. Other\n        # numbers are failures\n        tripleo_container_manage_valid_exit_code: [0, 2]\n\n- name: Diff puppet-generated changes for check mode\n  become: true\n  shell: |\n    diff -ruN --no-dereference -q /var/lib/config-data/puppet-generated /var/lib/config-data/check-mode/puppet-generated\n    diff -ruN --no-dereference /var/lib/config-data/puppet-generated /var/lib/config-data/check-mode/puppet-generated\n  register: diff_results\n  tags:\n    - container_config\n  check_mode: no\n  when:\n    - ansible_check_mode|bool\n    - ansible_diff_mode\n  failed_when: false\n  changed_when: diff_results.rc == 1\n\n- name: Diff puppet-generated changes for check mode\n  debug:\n    var: diff_results.stdout_lines\n  changed_when: diff_results.rc == 1\n  when:\n    - ansible_check_mode|bool\n    - ansible_diff_mode\n  tags:\n    - container_config\n", "file:///root/tripleo-heat-installer-templates/common/host-container-puppet-tasks.yaml": "- name: Write container-puppet-tasks json file for {{ansible_facts['hostname'] | lower}} step {{step}}\n  no_log: True\n  copy:\n    content: \"{{lookup ('vars', 'host_container_puppet_tasks_' ~ step, default=[]) | to_nice_json}}\"\n    dest: \"/var/lib/container-puppet/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}container-puppet-tasks{{step}}.json\"\n    force: yes\n    mode: '0600'\n  check_mode: no\n  tags:\n    - container_config_tasks\n\n- name: Block for container-puppet tasks (bootstrap tasks) for step {{ step }} with tripleo-ansible\n  tags:\n    - container_config_tasks\n  block:\n    - name: \"Generate container puppet configs for step {{ step }}\"\n      container_puppet_config:\n        check_mode: '{{ ansible_check_mode | bool | ternary(1, 0) }}'\n        config_vol_prefix: \"/var/lib/config-data{{ ansible_check_mode | bool | ternary('/check-mode', '') }}\"\n        debug: \"{{ docker_puppet_debug | bool }}\"\n        net_host: true\n        no_archive: true\n        puppet_config: \"/var/lib/container-puppet/{{ ansible_check_mode | bool | ternary('check-mode/', '') }}container-puppet-tasks{{ step }}.json\"\n        short_hostname: \"{{ ansible_facts['hostname'] | lower }}\"\n        step: \"{{ step }}\"\n\n    - name: \"Manage Puppet containers (bootstrap tasks) for step {{ step }} with tripleo-ansible\"\n      include_role:\n        name: tripleo_container_manage\n      vars:\n        tripleo_container_manage_concurrency: \"{{ docker_puppet_process_count }}\"\n        tripleo_container_manage_systemd_order: false\n        tripleo_container_manage_systemd_teardown: false\n        tripleo_container_manage_config: \"/var/lib/tripleo-config/container-puppet-config/step_{{ step }}\"\n        tripleo_container_manage_config_patterns: 'container-puppet-*.json'\n        tripleo_container_manage_config_id: \"tripleo_puppet_step{{ step }}\"\n        tripleo_container_manage_debug: \"{{ docker_puppet_debug | bool }}\"\n        # puppet with --detailed-exitcodes will return 0 for success and\n        # no changes and 2 for success and resource changes. Other\n        # numbers are failures\n        tripleo_container_manage_valid_exit_code: [0, 2]\n", "file:///root/tripleo-heat-installer-templates/common/post.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Post-deploy configuration steps via puppet for all roles, as defined in ../roles_data.yaml\\n\", \"parameters\": {\"servers\": {\"type\": \"json\", \"description\": \"Mapping of Role name e.g Controller to a list of servers\"}, \"role_data\": {\"type\": \"json\", \"description\": \"Mapping of Role name e.g Controller to the per-role data\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"deployment_source_hosts\": {\"default\": \"Undercloud\", \"type\": \"string\", \"description\": \"Host or hostgroup that runs the deployment\"}, \"deployment_target_hosts\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Host or hostgroup that consists of the target systems for the deployment. Defaults to all hosts in the current Heat stack if not set.\\n\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"HideSensitiveLogs\": {\"default\": true, \"type\": \"boolean\", \"description\": \"Set it to false if you don't want to activate the no_log feature within ansible modules.\\n\"}, \"EnablePuppet\": {\"default\": true, \"description\": \"Whether to run the puppet (baremetal) deployment tasks.\", \"type\": \"boolean\"}, \"EnablePaunch\": {\"default\": false, \"description\": \"(DEPRECATED) Whether to run paunch during container deployment tasks.\\n\", \"type\": \"boolean\"}, \"DockerPuppetDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debug logging with Puppet Containers\"}, \"DockerPuppetProcessCount\": {\"type\": \"number\", \"default\": 6, \"description\": \"Number of concurrent processes to use when running container-puppet to generate config files.\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DockerPuppetMountHostPuppet\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Whether containerized puppet executions use modules from the baremetal host. Defaults to true. Can be set to false to consume puppet modules from containers directly.\"}, \"ContainerLogStdoutPath\": {\"type\": \"string\", \"description\": \"Absolute path for container stdout output (Podman only)\", \"default\": \"/var/log/containers/stdouts\"}, \"ContainerHealthcheckDisabled\": {\"type\": \"boolean\", \"description\": \"Whether or not we disable the container healthcheck.\", \"default\": false}, \"SELinuxMode\": {\"default\": \"enforcing\", \"description\": \"Configures SELinux mode\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"enforcing\", \"permissive\", \"disabled\"]}]}, \"StandaloneCount\": {\"description\": \"Number of Standalone nodes to deploy\", \"type\": \"number\", \"default\": 1}, \"ServiceNetMapLower\": {\"description\": \"Mapping of service name to network name\", \"type\": \"json\", \"default\": {}}, \"ValidateControllersIcmp\": {\"default\": true, \"description\": \"Validation to ensure that all controllers can be reached with ICMP\", \"type\": \"boolean\"}, \"ValidateGatewaysIcmp\": {\"default\": true, \"description\": \"Validation to ensure that all gateways can be reached with ICMP\", \"type\": \"boolean\"}, \"ValidateFqdn\": {\"default\": false, \"description\": \"Optional validation to ensure FQDN as set by Nova matches the name set in /etc/hosts.\", \"type\": \"boolean\"}, \"PingTestGatewayIPsMap\": {\"default\": {}, \"description\": \"A map of role name to list of gateway IP addresses for each network, used to ping test each gateway.\", \"type\": \"json\"}, \"PingTestIpsMap\": {\"default\": \"\", \"description\": \"A map of role name to a space separated list of IP addresses used to ping test each available network interface.\", \"type\": \"json\"}, \"NetworkSafeDefaults\": {\"default\": true, \"description\": \"Allow to enable/disable safe networking defaults if os-net-config would fail to run with the provided config.\", \"type\": \"boolean\"}, \"DeployArtifactURLs\": {\"default\": [], \"description\": \"A list of HTTP URLs containing deployment artifacts to be pulled. Currently supports tarballs and RPM packages.\", \"type\": \"comma_delimited_list\"}, \"DeployArtifactFILEs\": {\"default\": [], \"description\": \"A list of files containing deployment artifacts to be pushed. Currently supports tarballs and RPM packages.\", \"type\": \"comma_delimited_list\"}, \"HostsEntry\": {\"default\": [], \"type\": \"comma_delimited_list\", \"description\": \"A list of entries to be added to /etc/hosts on each node.\"}, \"AnsibleHostVarsMap\": {\"type\": \"json\", \"default\": {}}, \"EnabledServices\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"ControlVirtualIP\": {\"type\": \"string\"}, \"EnabledNetworks\": {\"type\": \"comma_delimited_list\"}, \"NetVipMap\": {\"type\": \"json\"}, \"StorageNetName\": {\"default\": \"storage\", \"description\": \"The name of the storage network.\", \"type\": \"string\"}, \"StorageMgmtNetName\": {\"default\": \"storage_mgmt\", \"description\": \"The name of the storage_mgmt network.\", \"type\": \"string\"}, \"InternalApiNetName\": {\"default\": \"internal_api\", \"description\": \"The name of the internal_api network.\", \"type\": \"string\"}, \"TenantNetName\": {\"default\": \"tenant\", \"description\": \"The name of the tenant network.\", \"type\": \"string\"}, \"ExternalNetName\": {\"default\": \"external\", \"description\": \"The name of the external network.\", \"type\": \"string\"}, \"CloudNames\": {\"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"CloudDomain\": {\"default\": \"localdomain\", \"type\": \"string\", \"description\": \"The DNS domain used for the hosts. This must match the overcloud_domain_name configured on the undercloud.\\n\"}, \"NovaAdditionalCell\": {\"default\": false, \"description\": \"Whether this is an cell additional to the default cell.\", \"type\": \"boolean\"}, \"AllNodesExtraMapData\": {\"default\": {}, \"type\": \"json\", \"description\": \"Map of extra data (hieradata) to set on each node.\"}, \"UndercloudHostsEntries\": {\"default\": [], \"description\": \"List of undercloud hosts entries to be appended to /etc/hosts. The value is populated with the HEAT_HOSTS entries on the undercloud by tripleoclient when running deploy.\\n\", \"type\": \"comma_delimited_list\"}, \"ExtraHostsEntries\": {\"default\": [], \"description\": \"List of extra hosts entries to be appended to /etc/hosts\", \"type\": \"comma_delimited_list\"}, \"VipHostsEntries\": {\"default\": [], \"description\": \"List of VIP (virtual IP) hosts entries to be appended to /etc/hosts\", \"type\": \"comma_delimited_list\"}, \"KeystoneResourcesConfigs\": {\"description\": \"The keystone resources config.\", \"type\": \"json\", \"default\": {}}, \"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"NetCidrMap\": {\"description\": \"Mapping of CIDRs to network name\", \"type\": \"json\", \"default\": {}}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"EnablePaunch\", \"ServiceNetMapLower\"]}], \"conditions\": {\"StandaloneNonZero\": {\"not\": {\"equals\": [{\"get_param\": \"StandaloneCount\"}, 0]}}}, \"resources\": {\"PreDeployStepTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"list_concat_unique\": [{\"if\": [\"StandaloneNonZero\", {\"get_param\": [\"role_data\", \"Standalone\", \"pre_deploy_step_tasks\"]}, []]}]}}}, \"ExternalDeployTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"list_concat_unique\": [{\"if\": [\"StandaloneNonZero\", {\"get_param\": [\"role_data\", \"Standalone\", \"external_deploy_tasks\"]}, []]}]}}}, \"ExternalPostDeployTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"list_concat_unique\": [{\"if\": [\"StandaloneNonZero\", {\"get_param\": [\"role_data\", \"Standalone\", \"external_post_deploy_tasks\"]}, []]}]}}}, \"ScaleTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"list_concat_unique\": [{\"get_param\": [\"role_data\", \"Standalone\", \"scale_tasks\"]}]}}}, \"ExternalUpdateTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"list_concat_unique\": [{\"if\": [\"StandaloneNonZero\", {\"get_param\": [\"role_data\", \"Standalone\", \"external_update_tasks\"]}, []]}]}}}, \"ExternalUpgradeTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"list_concat_unique\": [{\"if\": [\"StandaloneNonZero\", {\"get_param\": [\"role_data\", \"Standalone\", \"external_upgrade_tasks\"]}, []]}]}}}, \"BootstrapServerId\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"yaql\": {\"expression\": \"switch($.data = {} => \\\"no_bootstrap_server\\\", $.data != {} => $.data.items().orderBy($[0]).first()[1])\", \"data\": {\"get_param\": [\"servers\", \"Standalone\"]}}}}}, \"StandaloneExtraConfigPost\": {\"condition\": \"StandaloneNonZero\", \"type\": \"OS::TripleO::NodeExtraConfigPost\", \"properties\": {\"servers\": {\"get_param\": [\"servers\", \"Standalone\"]}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}}}, \"StandalonePostConfig\": {\"condition\": \"StandaloneNonZero\", \"type\": \"OS::TripleO::Tasks::StandalonePostConfig\", \"depends_on\": [\"StandaloneExtraConfigPost\"], \"properties\": {\"servers\": {\"get_param\": \"servers\"}, \"input_values\": {\"deploy_identifier\": {\"get_param\": \"DeployIdentifier\"}}}}}, \"outputs\": {\"RoleConfig\": {\"description\": \"Mapping of config data for all roles\", \"value\": {\"global_vars\": {\"deploy_steps_max\": 6, \"service_net_map\": {\"get_param\": \"ServiceNetMapLower\"}, \"validate_controllers_icmp\": {\"get_param\": \"ValidateControllersIcmp\"}, \"validate_gateways_icmp\": {\"get_param\": \"ValidateGatewaysIcmp\"}, \"validate_fqdn\": {\"get_param\": \"ValidateFqdn\"}, \"ping_test_gateway_ips\": {\"get_param\": \"PingTestGatewayIPsMap\"}, \"ping_test_ips\": {\"get_param\": \"PingTestIpsMap\"}, \"network_safe_defaults\": {\"get_param\": \"NetworkSafeDefaults\"}, \"deploy_artifact_urls\": {\"get_param\": \"DeployArtifactURLs\"}, \"deploy_artifact_files\": {\"get_param\": \"DeployArtifactFILEs\"}, \"hosts_entry\": {\"get_param\": \"HostsEntry\"}, \"primary_role_name\": \"Standalone\", \"deploy_identifier\": {\"get_param\": \"DeployIdentifier\"}, \"container_cli\": {\"get_param\": \"ContainerCli\"}, \"enabled_services\": {\"get_param\": \"EnabledServices\"}, \"control_virtual_ip\": {\"get_param\": \"ControlVirtualIP\"}, \"enabled_networks\": {\"get_param\": \"EnabledNetworks\"}, \"net_vip_map\": {\"get_param\": \"NetVipMap\"}, \"nova_additional_cell\": {\"get_param\": \"NovaAdditionalCell\"}, \"hide_sensitive_logs\": {\"get_param\": \"HideSensitiveLogs\"}, \"storage_net_name\": {\"get_param\": \"StorageNetName\"}, \"storage_mgmt_net_name\": {\"get_param\": \"StorageMgmtNetName\"}, \"internal_api_net_name\": {\"get_param\": \"InternalApiNetName\"}, \"tenant_net_name\": {\"get_param\": \"TenantNetName\"}, \"external_net_name\": {\"get_param\": \"ExternalNetName\"}, \"networks\": {\"Storage\": {\"name\": {\"get_param\": \"StorageNetName\"}, \"name_lower\": \"storage\"}, \"StorageMgmt\": {\"name\": {\"get_param\": \"StorageMgmtNetName\"}, \"name_lower\": \"storage_mgmt\"}, \"InternalApi\": {\"name\": {\"get_param\": \"InternalApiNetName\"}, \"name_lower\": \"internal_api\"}, \"Tenant\": {\"name\": {\"get_param\": \"TenantNetName\"}, \"name_lower\": \"tenant\"}, \"External\": {\"name\": {\"get_param\": \"ExternalNetName\"}, \"name_lower\": \"external\"}}, \"network_virtual_ips\": {\"ctlplane\": {\"ip_address\": {\"get_param\": [\"NetVipMap\", \"ctlplane\"]}, \"index\": 1}, \"storage\": {\"ip_address\": {\"get_param\": [\"NetVipMap\", {\"get_param\": \"StorageNetName\"}]}, \"index\": 2}, \"storage_mgmt\": {\"ip_address\": {\"get_param\": [\"NetVipMap\", {\"get_param\": \"StorageMgmtNetName\"}]}, \"index\": 3}, \"internal_api\": {\"ip_address\": {\"get_param\": [\"NetVipMap\", {\"get_param\": \"InternalApiNetName\"}]}, \"index\": 4}, \"external\": {\"ip_address\": {\"get_param\": [\"NetVipMap\", {\"get_param\": \"ExternalNetName\"}]}, \"index\": 5}}, \"cloud_names\": {\"get_param\": \"CloudNames\"}, \"enable_internal_tls\": {\"get_param\": \"EnableInternalTLS\"}, \"cloud_domain\": {\"get_param\": \"CloudDomain\"}, \"all_nodes_extra_map_data\": {\"get_param\": \"AllNodesExtraMapData\"}, \"undercloud_hosts_entries\": {\"get_param\": \"UndercloudHostsEntries\"}, \"extra_hosts_entries\": {\"get_param\": \"ExtraHostsEntries\"}, \"vip_hosts_entries\": {\"get_param\": \"VipHostsEntries\"}, \"keystone_resources\": {\"get_param\": \"KeystoneResourcesConfigs\"}, \"net_cidr_map\": {\"get_param\": \"NetCidrMap\"}}, \"common_deploy_steps_playbooks\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/deploy-steps-playbooks-common.yaml\"}, \"common_deploy_steps_tasks\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/deploy-steps-tasks.yaml\"}, \"common_container_config_scripts\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/common-container-config-scripts.yaml\"}, \"hiera_steps_tasks\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/hiera-steps-tasks.yaml\"}, \"deploy_steps_tasks_step_0\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/deploy-steps-tasks-step-0.yaml\"}, \"common_container_setup_tasks\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/common-container-setup-tasks.yaml\"}, \"common_deploy_steps_tasks_step_1\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/deploy-steps-tasks-step-1.yaml\"}, \"container_puppet_script\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/container-puppet.sh\"}, \"generate-config-tasks\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/generate-config-tasks.yaml\"}, \"host-container-puppet-tasks\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/common/host-container-puppet-tasks.yaml\"}, \"deploy_steps_0_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External deployment step 0\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    step: 0\\n    enable_debug: ENABLE_DEBUG\\n  tasks:\\n    - name: External deployment step 0\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment step 0' to resume from this task\\n    - include_tasks: \\\"external_deploy_steps_tasks_step0.yaml\\\"\\n      when:\\n        - playbook_dir ~ '/external_deploy_steps_tasks_step0.yaml' is exists\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step0\\n\\n- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n\"}}, \"deploy_steps_selinux_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_linear\\n  name: Manage SELinux\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n    - name: Set selinux state\\n      become: true\\n      selinux:\\n        policy: targeted\\n        state: SELINUX_MODE\\n\\n- hosts: all\\n  strategy: tripleo_linear\\n  name: Generate /etc/hosts\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n\\n    - name: Configure Hosts Entries\\n      include_role:\\n        name: tripleo_hosts_entries\\n      vars:\\n        tripleo_hosts_entries_undercloud_hosts_entries: \\\"{{ undercloud_hosts_entries }}\\\"\\n        tripleo_hosts_entries_extra_hosts_entries: \\\"{{ extra_hosts_entries }}\\\"\\n        tripleo_hosts_entries_vip_hosts_entries: \\\"{{ vip_hosts_entries }}\\\"\\n\"}}, \"deploy_steps_common_roles_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_linear\\n  name: Common roles for TripleO servers\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  # pre_tasks run before any roles in a play, so we use it for the\\n  # named debug task for --start-at-task.\\n  pre_tasks:\\n    - name: Common roles for TripleO servers\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Common roles for TripleO servers' to resume from this task\\n  tasks:\\n    - include_role:\\n        name: tripleo_bootstrap\\n    - include_role:\\n        name: tripleo_ssh_known_hosts\\n  tags:\\n    - common_roles\\n\"}}, \"deploy_steps_0_tasks_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Deploy step tasks for step 0\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: 0\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: deploy_steps_tasks_step_0.yaml\\n  tags:\\n    - overcloud\\n    - deploy_steps\\n    - step0\\n\"}}, \"deploy_steps_pre_network_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Server pre network steps\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n  tasks:\\n\\n    - name: Server pre-network deployments\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Server pre-network deployments' to resume from this task\\n    - import_tasks: hiera_steps_tasks.yaml\\n    - include_tasks: deployments.yaml\\n      vars:\\n        force: false\\n      with_items: \\\"{{ hostvars[inventory_hostname]['pre_network_' ~ tripleo_role_name]|default([]) }}\\\"\\n\\n  tags:\\n    - overcloud\\n    - pre_deploy_steps\\n\"}}, \"deploy_steps_network_deployments_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Server network deployments\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n\\n    - name: Network Configuration\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Network Configuration' to resume from this task\\n    - name: Check NetworkConfig script existence\\n      delegate_to: localhost\\n      stat:\\n        path: \\\"{{ tripleo_role_name ~ '/NetworkConfig' }}\\\"\\n      register: NetworkConfig_stat\\n      when: not tripleo_network_config_with_ansible\\n    - name: Run Network Config\\n      import_role:\\n        name: tripleo_network_config\\n      vars:\\n        tripleo_network_config_script_path: \\\"{{ NetworkConfig_stat.stat.path }}\\\"\\n        tripleo_network_config_update: \\\"{{ network_config_update }}\\\"\\n        tripleo_network_config_nmstate: \\\"{{ use_nmstate }}\\\"\\n        tripleo_network_config_purge: \\\"{{ ifcfg_purge }}\\\"\\n        tripleo_network_config_async_timeout: \\\"{{ async_timeout | default(300) }}\\\"\\n        tripleo_network_config_async_poll: \\\"{{ async_poll | default(3) }}\\\"\\n        tripleo_network_config_hide_sensitive_logs: false\\n        tripleo_network_config_legacy_script: false\\n        tripleo_network_config_safe_defaults: \\\"{{ network_safe_defaults }}|bool\\\"\\n      when:\\n        - tripleo_network_config_with_ansible or NetworkConfig_stat.stat.exists\\n  tags:\\n    - overcloud\\n    - pre_deploy_steps\\n    - network_deploy_steps\\n\"}}, \"deploy_steps_network_validation_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Server network validation\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n\\n    - name: Basic Network Validation\\n      include_role:\\n        name: tripleo_nodes_validation\\n      vars:\\n        tripleo_nodes_validation_validate_controllers_icmp: \\\"{{ validate_controllers_icmp }}\\\"\\n        tripleo_nodes_validation_validate_gateway_icmp: \\\"{{ validate_gateways_icmp }}\\\"\\n        tripleo_nodes_validation_validate_fqdn: \\\"{{ validate_fqdn }}\\\"\\n        tripleo_nodes_validation_ping_test_ips: \\\"{{ ping_test_ips.get(tripleo_role_name, '').split() | list | unique }}\\\"\\n        tripleo_nodes_validation_ping_test_gateway_ips: \\\"{{ ping_test_gateway_ips.get(tripleo_role_name, []) }}\\\"\\n  tags:\\n    - overcloud\\n    - pre_deploy_steps\\n    - network_deploy_steps\\n\"}}, \"deploy_steps_pre_deployment_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Server pre deployment steps\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n    - name: Server pre deployments\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Server pre deployments' to resume from this task\\n\\n    - import_tasks: hiera_steps_tasks.yaml\\n    - include_tasks: deployments.yaml\\n      vars:\\n        force: false\\n      with_items: \\\"{{ hostvars[inventory_hostname]['pre_deployments_' ~ tripleo_role_name]|default([]) }}\\\"\\n\\n  tags:\\n    - overcloud\\n    - pre_deploy_steps\\n\"}}, \"deploy_steps_host_prep_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Host prep steps\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n\\n    - name: Host prep steps\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Host prep steps' to resume from this task\\n    - name: Deploy Artifacts\\n      tripleo_push_artifacts:\\n        artifact_urls: \\\"{{ deploy_artifact_urls | default([]) }}\\\"\\n        artifact_paths: \\\"{{ deploy_artifact_files | default([]) }}\\\"\\n      when:\\n        - ((deploy_artifact_urls | default([]) | length) > 0) or\\n          ((deploy_artifact_files | default([]) | length) > 0)\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/host_prep_tasks.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n  tags:\\n    - overcloud\\n    - host_prep_steps\\n\"}}, \"deploy_steps_container_setup_tasks_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Overcloud container setup tasks\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: Overcloud container setup tasks\\n      block:\\n        - name: Overcloud container setup tasks\\n          delegate_to: localhost\\n          run_once: true\\n          debug:\\n            msg: Use --start-at-task 'Overcloud container setup tasks' to resume from this task\\n        - name: Write config data\\n          include_tasks: common_container_setup_tasks.yaml\\n          when:\\n            - (deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none)\\n  tags:\\n    - overcloud\\n    - container_setup_tasks\\n\"}}, \"deploy_steps_pre_deployment_tasks_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Pre Deployment Step Tasks\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n\\n    - name: Pre Deployment Step Tasks\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Pre Deployment Step Tasks' to resume from this task\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/pre_deploy_step_tasks.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n  tags:\\n    - overcloud\\n    - pre_deploy_steps_tasks\\n\"}}, \"deploy_steps_external_deployment_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External deployment step 1\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '1'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: External deployment step 1\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment step 1' to resume from this task\\n    - include_tasks: \\\"external_deploy_steps_tasks_step1.yaml\\\"\\n      when:\\n        - playbook_dir ~ '/external_deploy_steps_tasks_step1.yaml' is exists\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step1\\n\\n- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Deploy step tasks for 1\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '1'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: Deploy step tasks for 1\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Deploy step tasks for 1' to resume from this task\\n    - name: Write the config_step hieradata for the deploy step 1 tasks\\n\\n      copy:\\n        content: \\\"{{ dict(step=step | int) | to_json }}\\\"\\n        dest: /etc/puppet/hieradata/config_step.json\\n        force: true\\n        mode: '0600'\\n\\n\\n    - name: Overcloud common bootstrap tasks for step 1\\n      block:\\n        - name: \\\"Check if /var/lib/tripleo-config/container-startup-config/step_1 already exists\\\"\\n          stat:\\n            path: \\\"/var/lib/tripleo-config/container-startup-config/step_1\\\"\\n          register: container_startup_configs_json_stat\\n        - name: Write config data at the start of step 1\\n          include_tasks: common_deploy_steps_tasks_step_1.yaml\\n          when:\\n            - ((deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none) or\\n              not container_startup_configs_json_stat.stat.exists)\\n\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/deploy_steps_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n\\n    - name: Overcloud common deploy step tasks 1\\n      block:\\n        - name: \\\"Check if /var/lib/tripleo-config/container-startup-config/step_1 already exists\\\"\\n          stat:\\n            path: \\\"/var/lib/tripleo-config/container-startup-config/step_1\\\"\\n          register: container_startup_configs_json_stat\\n        - include_tasks: common_deploy_steps_tasks.yaml\\n          when: (deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none) or\\n                (container_startup_configs_json_stat is defined and not container_startup_configs_json_stat.stat.exists)\\n  tags:\\n    - overcloud\\n    - deploy_steps\\n    - step1\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External deployment step 2\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '2'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: External deployment step 2\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment step 2' to resume from this task\\n    - include_tasks: \\\"external_deploy_steps_tasks_step2.yaml\\\"\\n      when:\\n        - playbook_dir ~ '/external_deploy_steps_tasks_step2.yaml' is exists\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step2\\n\\n- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Deploy step tasks for 2\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '2'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: Deploy step tasks for 2\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Deploy step tasks for 2' to resume from this task\\n    - name: Write the config_step hieradata for the deploy step 2 tasks\\n\\n      copy:\\n        content: \\\"{{ dict(step=step | int) | to_json }}\\\"\\n        dest: /etc/puppet/hieradata/config_step.json\\n        force: true\\n        mode: '0600'\\n\\n\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/deploy_steps_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n\\n    - name: Overcloud common deploy step tasks 2\\n      block:\\n        - name: \\\"Check if /var/lib/tripleo-config/container-startup-config/step_2 already exists\\\"\\n          stat:\\n            path: \\\"/var/lib/tripleo-config/container-startup-config/step_2\\\"\\n          register: container_startup_configs_json_stat\\n        - include_tasks: common_deploy_steps_tasks.yaml\\n          when: (deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none) or\\n                (container_startup_configs_json_stat is defined and not container_startup_configs_json_stat.stat.exists)\\n  tags:\\n    - overcloud\\n    - deploy_steps\\n    - step2\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External deployment step 3\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '3'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: External deployment step 3\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment step 3' to resume from this task\\n    - include_tasks: \\\"external_deploy_steps_tasks_step3.yaml\\\"\\n      when:\\n        - playbook_dir ~ '/external_deploy_steps_tasks_step3.yaml' is exists\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step3\\n\\n- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Deploy step tasks for 3\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '3'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: Deploy step tasks for 3\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Deploy step tasks for 3' to resume from this task\\n    - name: Write the config_step hieradata for the deploy step 3 tasks\\n\\n      copy:\\n        content: \\\"{{ dict(step=step | int) | to_json }}\\\"\\n        dest: /etc/puppet/hieradata/config_step.json\\n        force: true\\n        mode: '0600'\\n\\n\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/deploy_steps_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n\\n    - name: Overcloud common deploy step tasks 3\\n      block:\\n        - name: \\\"Check if /var/lib/tripleo-config/container-startup-config/step_3 already exists\\\"\\n          stat:\\n            path: \\\"/var/lib/tripleo-config/container-startup-config/step_3\\\"\\n          register: container_startup_configs_json_stat\\n        - include_tasks: common_deploy_steps_tasks.yaml\\n          when: (deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none) or\\n                (container_startup_configs_json_stat is defined and not container_startup_configs_json_stat.stat.exists)\\n  tags:\\n    - overcloud\\n    - deploy_steps\\n    - step3\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External deployment step 4\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '4'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: External deployment step 4\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment step 4' to resume from this task\\n    - include_tasks: \\\"external_deploy_steps_tasks_step4.yaml\\\"\\n      when:\\n        - playbook_dir ~ '/external_deploy_steps_tasks_step4.yaml' is exists\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step4\\n\\n- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Deploy step tasks for 4\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '4'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: Deploy step tasks for 4\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Deploy step tasks for 4' to resume from this task\\n    - name: Write the config_step hieradata for the deploy step 4 tasks\\n\\n      copy:\\n        content: \\\"{{ dict(step=step | int) | to_json }}\\\"\\n        dest: /etc/puppet/hieradata/config_step.json\\n        force: true\\n        mode: '0600'\\n\\n\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/deploy_steps_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n\\n    - name: Overcloud common deploy step tasks 4\\n      block:\\n        - name: \\\"Check if /var/lib/tripleo-config/container-startup-config/step_4 already exists\\\"\\n          stat:\\n            path: \\\"/var/lib/tripleo-config/container-startup-config/step_4\\\"\\n          register: container_startup_configs_json_stat\\n        - include_tasks: common_deploy_steps_tasks.yaml\\n          when: (deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none) or\\n                (container_startup_configs_json_stat is defined and not container_startup_configs_json_stat.stat.exists)\\n  tags:\\n    - overcloud\\n    - deploy_steps\\n    - step4\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External deployment step 5\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '5'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: External deployment step 5\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment step 5' to resume from this task\\n    - include_tasks: \\\"external_deploy_steps_tasks_step5.yaml\\\"\\n      when:\\n        - playbook_dir ~ '/external_deploy_steps_tasks_step5.yaml' is exists\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step5\\n\\n- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Deploy step tasks for 5\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '5'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: Deploy step tasks for 5\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Deploy step tasks for 5' to resume from this task\\n    - name: Write the config_step hieradata for the deploy step 5 tasks\\n\\n      copy:\\n        content: \\\"{{ dict(step=step | int) | to_json }}\\\"\\n        dest: /etc/puppet/hieradata/config_step.json\\n        force: true\\n        mode: '0600'\\n\\n\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/deploy_steps_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n\\n    - name: Overcloud common deploy step tasks 5\\n      block:\\n        - name: \\\"Check if /var/lib/tripleo-config/container-startup-config/step_5 already exists\\\"\\n          stat:\\n            path: \\\"/var/lib/tripleo-config/container-startup-config/step_5\\\"\\n          register: container_startup_configs_json_stat\\n        - include_tasks: common_deploy_steps_tasks.yaml\\n          when: (deploy_identifier is defined and deploy_identifier != \\\"\\\" and deploy_identifier is not none) or\\n                (container_startup_configs_json_stat is defined and not container_startup_configs_json_stat.stat.exists)\\n  tags:\\n    - overcloud\\n    - deploy_steps\\n    - step5\\n\"}}, \"deploy_steps_post_deployment_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"\\n- hosts: Standalone:DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Server Post Deployments\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n    - name: Server Post Deployments\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'Server Post Deployments' to resume from this task\\n\\n    - include_tasks: deployments.yaml\\n      vars:\\n        force: false\\n      with_items: \\\"{{ hostvars[inventory_hostname]['post_deployments_' ~ tripleo_role_name]|default([]) }}\\\"\\n  tags:\\n    - overcloud\\n    - post_deploy_steps\\n\"}}, \"deploy_steps_post_deploy_tasks_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_linear\\n  name: External deployment Post Deploy tasks\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - name: External deployment Post Deploy tasks\\n      delegate_to: localhost\\n      run_once: true\\n      debug:\\n        msg: Use --start-at-task 'External deployment Post Deploy tasks' to resume from this task\\n    - import_tasks: external_post_deploy_steps_tasks.yaml\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - external_post_deploy_steps\\n\"}}, \"deploy_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- import_playbook: deploy_steps_0_playbook.yaml\\n- import_playbook: deploy_steps_selinux_playbook.yaml\\n- import_playbook: deploy_steps_common_roles_playbook.yaml\\n- import_playbook: deploy_steps_0_tasks_playbook.yaml\\n- import_playbook: deploy_steps_pre_network_playbook.yaml\\n- import_playbook: deploy_steps_network_deployments_playbook.yaml\\n- import_playbook: deploy_steps_network_validation_playbook.yaml\\n- import_playbook: deploy_steps_pre_deployment_playbook.yaml\\n- import_playbook: deploy_steps_host_prep_playbook.yaml\\n- import_playbook: deploy_steps_container_setup_tasks_playbook.yaml\\n- import_playbook: deploy_steps_pre_deployment_tasks_playbook.yaml\\n- import_playbook: deploy_steps_external_deployment_playbook.yaml\\n- import_playbook: deploy_steps_post_deployment_playbook.yaml\\n- import_playbook: deploy_steps_post_deploy_tasks_playbook.yaml\\n\"}}, \"external_deploy_steps_tasks\": {\"get_attr\": [\"ExternalDeployTasks\", \"value\"]}, \"external_post_deploy_steps_tasks\": {\"get_attr\": [\"ExternalPostDeployTasks\", \"value\"]}, \"pre_deploy_step_tasks\": {\"get_attr\": [\"PreDeployStepTasks\", \"value\"]}, \"update_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_linear\\n  name: External update step 0\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: 0\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks:\\n        file: external_update_steps_tasks.yaml\\n      delegate_to: localhost\\n      run_once: true\\n  tags:\\n    - step0\\n    - external\\n    - external_update_steps\\n- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n- hosts: Standalone\\n  name: Run update\\n  become: true\\n  serial: \\\"{{ update_serial | default(1)}}\\\"\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n    tripleo_minor_update: true\\n    tripleo_redhat_enforce: true\\n    \\n  tasks:\\n    - import_tasks: hiera_steps_tasks.yaml\\n    - import_tasks: common_container_config_scripts.yaml\\n    - name: Make sure container configuration is refreshed\\n      import_tasks: common_container_setup_tasks.yaml\\n    - import_tasks: \\\"Standalone/update_tasks_step0.yaml\\\"\\n      vars:\\n        step: \\\"0\\\"\\n    - import_tasks: \\\"Standalone/update_tasks_step1.yaml\\\"\\n      vars:\\n        step: \\\"1\\\"\\n    - import_tasks: \\\"Standalone/update_tasks_step2.yaml\\\"\\n      vars:\\n        step: \\\"2\\\"\\n    - import_tasks: \\\"Standalone/update_tasks_step3.yaml\\\"\\n      vars:\\n        step: \\\"3\\\"\\n    - import_tasks: \\\"Standalone/update_tasks_step4.yaml\\\"\\n      vars:\\n        step: \\\"4\\\"\\n    - import_tasks: \\\"Standalone/update_tasks_step5.yaml\\\"\\n      vars:\\n        step: \\\"5\\\"\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/host_prep_tasks.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n\\n    - import_tasks: deploy_steps_tasks_step_0.yaml\\n      vars:\\n        step: 0\\n    - name: Write config data at the start of step 1\\n      import_tasks: common_deploy_steps_tasks_step_1.yaml\\n    - import_tasks: common_deploy_steps_tasks.yaml\\n      vars:\\n        step: \\\"1\\\"\\n    - import_tasks: common_deploy_steps_tasks.yaml\\n      vars:\\n        step: \\\"2\\\"\\n    - import_tasks: common_deploy_steps_tasks.yaml\\n      vars:\\n        step: \\\"3\\\"\\n    - import_tasks: common_deploy_steps_tasks.yaml\\n      vars:\\n        step: \\\"4\\\"\\n    - import_tasks: common_deploy_steps_tasks.yaml\\n      vars:\\n        step: \\\"5\\\"\\n    - import_tasks: \\\"Standalone/post_update_tasks_step0.yaml\\\"\\n      vars:\\n        step: \\\"0\\\"\\n    - import_tasks: \\\"Standalone/post_update_tasks_step1.yaml\\\"\\n      vars:\\n        step: \\\"1\\\"\\n    - import_tasks: \\\"Standalone/post_update_tasks_step2.yaml\\\"\\n      vars:\\n        step: \\\"2\\\"\\n    - import_tasks: \\\"Standalone/post_update_tasks_step3.yaml\\\"\\n      vars:\\n        step: \\\"3\\\"\\n\"}}, \"external_update_steps_tasks\": {\"get_attr\": [\"ExternalUpdateTasks\", \"value\"]}, \"external_update_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- hosts: DEPLOY_SOURCE_HOST\\n  name: External update step 0\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: 0\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_update_steps_tasks.yaml\\n  tags:\\n    - step0\\n    - external\\n    - external_update_steps\\n- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External update step 1\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '1'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_update_steps_tasks.yaml\\n  tags:\\n    - step1\\n    - external\\n    - external_update_steps\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External update step 2\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '2'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_update_steps_tasks.yaml\\n  tags:\\n    - step2\\n    - external\\n    - external_update_steps\\n# putting both update and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from update tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 1\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '1'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step1\\n# putting both update and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from update tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 2\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '2'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step2\\n# putting both update and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from update tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 3\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '3'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step3\\n# putting both update and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from update tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 4\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '4'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step4\\n# putting both update and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from update tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 5\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '5'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - external\\n    - external_deploy_steps\\n    - step5\\n\"}}, \"pre_upgrade_rolling_steps_tasks\": \"\\n- include_tasks: \\\"{{ _task_file_path }}\\\"\\n  vars:\\n    _task_file_path: \\\"{{ tripleo_role_name }}/pre_upgrade_rolling_tasks.yaml\\\"\\n  when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n  tags:\\n    - always\\n\", \"pre_upgrade_rolling_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST:Standalone\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n- hosts: Standalone\\n  name: Run pre-upgrade rolling tasks\\n  serial:  1\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  tasks:\\n    - include_tasks: pre_upgrade_rolling_steps_tasks.yaml\\n      with_sequence: start=0 end=0\\n      loop_control:\\n        loop_var: step\\n\"}}, \"upgrade_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Upgrade tasks for step 0\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '0'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n  tasks:\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/upgrade_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n      tags:\\n        - always\\n\\n  tags:\\n    - upgrade_steps\\n    - upgrade_step0\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Upgrade tasks for step 1\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '1'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n  tasks:\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/upgrade_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n      tags:\\n        - always\\n\\n  tags:\\n    - upgrade_steps\\n    - upgrade_step1\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Upgrade tasks for step 2\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '2'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n  tasks:\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/upgrade_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n      tags:\\n        - always\\n\\n  tags:\\n    - upgrade_steps\\n    - upgrade_step2\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Upgrade tasks for step 3\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '3'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n  tasks:\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/upgrade_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n      tags:\\n        - always\\n\\n  tags:\\n    - upgrade_steps\\n    - upgrade_step3\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Upgrade tasks for step 4\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '4'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n  tasks:\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/upgrade_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n      tags:\\n        - always\\n\\n  tags:\\n    - upgrade_steps\\n    - upgrade_step4\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  name: Upgrade tasks for step 5\\n  become: true\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    step: '5'\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n  tasks:\\n\\n    - include_tasks: \\\"{{ _task_file_path }}\\\"\\n      vars:\\n        _task_file_path: \\\"{{ tripleo_role_name }}/upgrade_tasks_step{{ step }}.yaml\\\"\\n      when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n      tags:\\n        - always\\n\\n  tags:\\n    - upgrade_steps\\n    - upgrade_step5\\n\"}}, \"post_upgrade_steps_tasks\": \"\\n- include_tasks: \\\"{{ _task_file_path }}\\\"\\n  vars:\\n    _task_file_path: \\\"{{ tripleo_role_name }}/post_upgrade_tasks.yaml\\\"\\n  when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n  tags:\\n    - always\\n\", \"post_upgrade_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n- hosts: DEPLOY_TARGET_HOST\\n  strategy: tripleo_free\\n  any_errors_fatal: yes\\n  tasks:\\n    - include_tasks: post_upgrade_steps_tasks.yaml\\n      with_sequence: start=0 end=3\\n      vars:\\n        bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n        deploy_identifier: DEPLOY_IDENTIFIER\\n        enable_debug: ENABLE_DEBUG\\n        enable_puppet: ENABLE_PUPPET\\n        container_cli: CONTAINER_CLI\\n        container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n        container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n        docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n        docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n        docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n      loop_control:\\n        loop_var: step\\n\"}}, \"external_upgrade_steps_tasks\": {\"get_attr\": [\"ExternalUpgradeTasks\", \"value\"]}, \"external_upgrade_steps_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External upgrade step 0\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '0'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_upgrade_steps_tasks.yaml\\n  tags:\\n    - step0\\n    - external\\n    - external_upgrade_steps\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External upgrade step 1\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '1'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_upgrade_steps_tasks.yaml\\n  tags:\\n    - step1\\n    - external\\n    - external_upgrade_steps\\n- hosts: DEPLOY_SOURCE_HOST\\n  strategy: tripleo_free\\n  name: External upgrade step 2\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '2'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_upgrade_steps_tasks.yaml\\n  tags:\\n    - step2\\n    - external\\n    - external_upgrade_steps\\n# putting both upgrade and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from upgrade tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 1\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '1'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - step1\\n    - external\\n    - external_deploy_steps\\n# putting both upgrade and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from upgrade tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 2\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '2'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - step2\\n    - external\\n    - external_deploy_steps\\n# putting both upgrade and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from upgrade tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 3\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '3'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - step3\\n    - external\\n    - external_deploy_steps\\n# putting both upgrade and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from upgrade tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 4\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '4'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - step4\\n    - external\\n    - external_deploy_steps\\n# putting both upgrade and deploy tasks in the same\\n# playbook allows influencing the deploy tasks by\\n# variables \\\"exported\\\" from upgrade tasks\\n- hosts: DEPLOY_SOURCE_HOST\\n  name: External deploy step 5\\n  gather_facts: \\\"{{ gather_facts | default(false) }}\\\"\\n  any_errors_fatal: yes\\n  become: false\\n  vars:\\n    # Explicit ansible_python_interpreter to allow connecting\\n    # to different OS releases (EL7/8) while using delegate_to.\\n    ansible_python_interpreter: /usr/libexec/platform-python\\n    step: '5'\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    container_healthcheck_disabled: CONTAINER_HEALTHCHECK_DISABLED\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    - import_tasks: external_deploy_steps_tasks.yaml\\n  tags:\\n    - step5\\n    - external\\n    - external_deploy_steps\\n\"}}, \"scale_steps_tasks\": {\"get_attr\": [\"ScaleTasks\", \"value\"]}, \"scale_playbook\": {\"str_replace\": {\"params\": {\"BOOTSTRAP_SERVER_ID\": {\"get_attr\": [\"BootstrapServerId\", \"value\"]}, \"DEPLOY_SOURCE_HOST\": {\"get_param\": \"deployment_source_hosts\"}, \"DEPLOY_TARGET_HOST\": {\"if\": [{\"equals\": [{\"get_param\": \"deployment_target_hosts\"}, \"\"]}, {\"get_param\": \"RootStackName\"}, {\"get_param\": \"deployment_target_hosts\"}]}, \"DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"ENABLE_DEBUG\": {\"get_param\": \"ConfigDebug\"}, \"ENABLE_PUPPET\": {\"get_param\": \"EnablePuppet\"}, \"CONTAINER_CLI\": {\"get_param\": \"ContainerCli\"}, \"CONTAINER_LOG_STDOUT_PATH\": {\"get_param\": \"ContainerLogStdoutPath\"}, \"CONTAINER_HEALTHCHECK_DISABLED\": {\"get_param\": \"ContainerHealthcheckDisabled\"}, \"DOCKER_PUPPET_DEBUG\": {\"get_param\": \"DockerPuppetDebug\"}, \"DOCKER_PUPPET_PROCESS_COUNT\": {\"get_param\": \"DockerPuppetProcessCount\"}, \"DOCKER_PUPPET_MOUNT_HOST_PUPPET\": {\"get_param\": \"DockerPuppetMountHostPuppet\"}, \"SELINUX_MODE\": {\"get_param\": \"SELinuxMode\"}}, \"template\": \"# Collect the facts from the overcloud nodes but ignore unreachable\\n# nodes in the case of a dead node which needs to be part of the\\n# scale-down operation.\\n- import_playbook: common_deploy_steps_playbooks.yaml\\n  vars:\\n    deploy_source_host: \\\"DEPLOY_SOURCE_HOST\\\"\\n    deploy_target_host: \\\"DEPLOY_TARGET_HOST\\\"\\n\\n- hosts: DEPLOY_TARGET_HOST\\n  name: Scaling\\n  # NOTE(cloudnull): This is set to true explicitly so that we have up-to-date facts\\n  #                  on all DEPLOY_TARGET_HOST when performing a scaling operation.\\n  #                  Without up-to-date facts, we're creating a potential failure\\n  #                  scenario.\\n  gather_facts: true\\n  ignore_unreachable: true\\n  become: false\\n  vars:\\n    bootstrap_server_id: BOOTSTRAP_SERVER_ID\\n    deploy_identifier: DEPLOY_IDENTIFIER\\n    enable_debug: ENABLE_DEBUG\\n    enable_puppet: ENABLE_PUPPET\\n    container_cli: CONTAINER_CLI\\n    container_log_stdout_path: CONTAINER_LOG_STDOUT_PATH\\n    docker_puppet_debug: DOCKER_PUPPET_DEBUG\\n    docker_puppet_process_count: DOCKER_PUPPET_PROCESS_COUNT\\n    docker_puppet_mount_host_puppet: DOCKER_PUPPET_MOUNT_HOST_PUPPET\\n  tasks:\\n    # Only run the scale tasks on the nodes that are alive.\\n    # We expect the tasks to work on the nodes that are alive.\\n    # If a task is allowed to fail, it needs to be configured at\\n    # the task definition level but not here.\\n    - include_tasks: scale_steps_tasks.yaml\\n      with_sequence: start=1 end=1\\n      loop_control:\\n        loop_var: step\\n      tags: always\\n      # we use ansible_facts['hostname'] to determine if the host is alive\\n      # or not.\\n      when: ansible_facts['hostname'] is defined\\n    # We don't want to run the scale tasks on dead nodes, to allow\\n    # the operator to scale down the cloud no matter the state of\\n    # the servers.\\n    # However, we notify the operator if the node wasn't reachable.\\n    # Using fail and not debug module to make it more visible\\n    # in the logs.\\n    - fail:\\n        msg: \\\"Node is unreachable. No scale tasks will be run.\\\"\\n      ignore_errors: True\\n      tags: always\\n      # we use ansible_facts['hostname'] to determine if the host is alive\\n      # or not.\\n      when: ansible_facts['hostname'] is not defined\\n  tags:\\n    - scale\\n\"}}, \"post_update_steps_tasks\": \"\\n- include_tasks: \\\"{{ _task_file_path }}\\\"\\n  vars:\\n    _task_file_path: \\\"{{ tripleo_role_name }}/post_update_tasks.yaml\\\"\\n  when: \\\"'{{ playbook_dir }}/{{ _task_file_path }}' is exists\\\"\\n  tags:\\n    - always\"}}}}", "file:///root/tripleo-heat-installer-templates/puppet/standalone-role.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Standalone node configured by Puppet\", \"parameters\": {\"OvercloudStandaloneFlavor\": {\"description\": \"Flavor for the Standalone node.\", \"default\": \"baremetal\", \"type\": \"string\"}, \"StandaloneImage\": {\"type\": \"string\", \"default\": \"overcloud-full\", \"description\": \"The disk image file to use for the role.\"}, \"ImageUpdatePolicy\": {\"default\": \"REBUILD_PRESERVE_EPHEMERAL\", \"description\": \"What policy to use when reconstructing instances. REBUILD for rebuilds, REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.\", \"type\": \"string\"}, \"KeyName\": {\"description\": \"Name of an existing Nova key pair to enable SSH access to the instances\", \"type\": \"string\", \"default\": \"default\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"UpdateIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting to a previously unused value during stack-update will trigger package update on all nodes\\n\"}, \"Hostname\": {\"type\": \"string\", \"default\": \"\"}, \"HostnameMap\": {\"type\": \"json\", \"default\": {}, \"description\": \"Optional mapping to override hostnames\"}, \"StandaloneIPs\": {\"default\": {}, \"type\": \"json\"}, \"SoftwareConfigTransport\": {\"default\": \"POLL_SERVER_CFN\", \"description\": \"How the server should receive the metadata required for software configuration.\\n\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"POLL_SERVER_CFN\", \"POLL_SERVER_HEAT\", \"POLL_TEMP_URL\", \"ZAQAR_MESSAGE\"]}]}, \"CloudDomain\": {\"default\": \"localdomain\", \"type\": \"string\", \"description\": \"The DNS domain used for the hosts. This must match the overcloud_domain_name configured on the undercloud.\\n\"}, \"StandaloneServerMetadata\": {\"default\": {}, \"description\": \"Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API. This option is role-specific and is merged with the values given to the ServerMetadata parameter.\\n\", \"type\": \"json\"}, \"ServerMetadata\": {\"default\": {}, \"description\": \"Extra properties or metadata passed to Nova for the created nodes in the overcloud. It's accessible via the Nova metadata API. This applies to all roles and is merged with a role-specific metadata parameter.\\n\", \"type\": \"json\"}, \"StandaloneSchedulerHints\": {\"type\": \"json\", \"description\": \"Optional scheduler hints to pass to nova\", \"default\": {}}, \"NodeIndex\": {\"type\": \"number\", \"default\": 0}, \"ServiceNames\": {\"type\": \"comma_delimited_list\", \"default\": []}, \"MonitoringSubscriptions\": {\"type\": \"comma_delimited_list\", \"default\": []}, \"ServiceMetadataSettings\": {\"type\": \"json\", \"default\": {}}, \"OVNBridgeMappings\": {\"type\": \"comma_delimited_list\", \"default\": []}, \"ConfigCommand\": {\"type\": \"string\", \"description\": \"Command which will be run whenever configuration data changes\", \"default\": \"os-refresh-config --timeout 14400\"}, \"ConfigCollectSplay\": {\"type\": \"number\", \"default\": 30, \"description\": \"Maximum amount of time to possibly to delay configuration collection\\npolling. Defaults to 30 seconds. Set to 0 to disable it which will cause\\nthe configuration collection to occur as soon as the collection process\\nstarts.  This setting is used to prevent the configuration collection\\nprocesses from polling all at the exact same time.\\n\"}, \"UpgradeInitCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\ninitialize the upgrade process. E.g. a repository switch.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"UpgradeInitCommonCommand\": {\"type\": \"string\", \"description\": \"Common commands required by the upgrades process. This should not\\nnormally be modified by the operator and is set and unset in the\\nmajor-upgrade-composable-steps.yaml and major-upgrade-converge.yaml\\nenvironment files.\\n\", \"default\": \"\"}, \"DeploymentServerBlacklistDict\": {\"default\": {}, \"type\": \"json\", \"description\": \"Map of server hostnames to blacklist from any triggered deployments. If the value is 1, the server will be blacklisted. This parameter is generated from the parent template.\\n\"}, \"RoleParameters\": {\"type\": \"json\", \"description\": \"Parameters specific to the role\", \"default\": {}}, \"StandaloneControlPlaneSubnet\": {\"default\": \"ctlplane-subnet\", \"description\": \"Name of the subnet on ctlplane network for this role.\\n\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ServerDeletionPolicy\": {\"description\": \"Whether to retain or delete servers on deletion of the stack\", \"type\": \"string\", \"default\": \"delete\", \"constraints\": [{\"allowed_values\": [\"delete\", \"retain\"]}]}, \"UserData\": {\"type\": \"string\"}}, \"conditions\": {\"server_blacklisted\": {\"or\": [{\"equals\": [{\"get_param\": [\"DeploymentServerBlacklistDict\", {\"get_param\": \"Hostname\"}]}, 1]}, {\"equals\": [{\"get_param\": [\"DeploymentServerBlacklistDict\", {\"get_param\": [\"HostnameMap\", {\"get_param\": \"Hostname\"}]}]}, 1]}]}, \"server_not_blacklisted\": {\"and\": [{\"not\": {\"equals\": [{\"get_param\": [\"DeploymentServerBlacklistDict\", {\"get_param\": \"Hostname\"}]}, 1]}}, {\"not\": {\"equals\": [{\"get_param\": [\"DeploymentServerBlacklistDict\", {\"get_param\": [\"HostnameMap\", {\"get_param\": \"Hostname\"}]}]}, 1]}}]}, \"ctlplane_fixed_ip_set\": {\"or\": [{\"not\": {\"equals\": [{\"get_param\": [\"StandaloneIPs\", \"ctlplane\", {\"get_param\": \"NodeIndex\"}]}, \"\"]}}, false]}, \"Standalone_Storage_fixed_ip_set\": {\"not\": {\"equals\": [{\"get_param\": [\"StandaloneIPs\", \"storage\", {\"get_param\": \"NodeIndex\"}]}, \"\"]}}, \"Standalone_StorageMgmt_fixed_ip_set\": {\"not\": {\"equals\": [{\"get_param\": [\"StandaloneIPs\", \"storage_mgmt\", {\"get_param\": \"NodeIndex\"}]}, \"\"]}}, \"Standalone_InternalApi_fixed_ip_set\": {\"not\": {\"equals\": [{\"get_param\": [\"StandaloneIPs\", \"internal_api\", {\"get_param\": \"NodeIndex\"}]}, \"\"]}}, \"Standalone_Tenant_fixed_ip_set\": {\"not\": {\"equals\": [{\"get_param\": [\"StandaloneIPs\", \"tenant\", {\"get_param\": \"NodeIndex\"}]}, \"\"]}}, \"Standalone_External_fixed_ip_set\": {\"not\": {\"equals\": [{\"get_param\": [\"StandaloneIPs\", \"external\", {\"get_param\": \"NodeIndex\"}]}, \"\"]}}}, \"resources\": {\"Standalone\": {\"type\": \"OS::TripleO::StandaloneServer\", \"deletion_policy\": {\"get_param\": \"ServerDeletionPolicy\"}, \"properties\": {\"image\": {\"get_param\": \"StandaloneImage\"}, \"image_update_policy\": {\"get_param\": \"ImageUpdatePolicy\"}, \"flavor\": {\"get_param\": \"OvercloudStandaloneFlavor\"}, \"key_name\": {\"get_param\": \"KeyName\"}, \"networks\": [{\"if\": [\"ctlplane_fixed_ip_set\", {\"network\": \"ctlplane\", \"subnet\": {\"get_param\": \"StandaloneControlPlaneSubnet\"}, \"fixed_ip\": {\"yaql\": {\"expression\": \"$.data.where(not isEmpty($)).first()\", \"data\": [{\"get_param\": [\"StandaloneIPs\", \"ctlplane\", {\"get_param\": \"NodeIndex\"}]}]}}}, {\"network\": \"ctlplane\", \"subnet\": {\"get_param\": \"StandaloneControlPlaneSubnet\"}}]}], \"user_data_format\": \"SOFTWARE_CONFIG\", \"user_data\": {\"get_param\": \"UserData\"}, \"name\": {\"yaql\": {\"expression\": \"$.data.hostname_map.get($.data.hostname, $.data.hostname).toLower()\", \"data\": {\"hostname\": {\"get_param\": \"Hostname\"}, \"hostname_map\": {\"get_param\": \"HostnameMap\"}}}}, \"software_config_transport\": {\"get_param\": \"SoftwareConfigTransport\"}, \"metadata\": {\"map_merge\": [{\"get_param\": \"ServerMetadata\"}, {\"get_param\": \"StandaloneServerMetadata\"}, {\"get_param\": \"ServiceMetadataSettings\"}]}, \"scheduler_hints\": {\"get_param\": \"StandaloneSchedulerHints\"}}}, \"StoragePort\": {\"type\": \"OS::TripleO::Standalone::Ports::StoragePort\", \"properties\": {\"PortName\": {\"list_join\": [\"_\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"Storage\"]]}, \"DnsName\": {\"get_attr\": [\"Standalone\", \"name\"]}, \"ControlPlaneIP\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"FixedIPs\": {\"if\": [\"Standalone_Storage_fixed_ip_set\", [{\"ip_address\": {\"get_param\": [\"StandaloneIPs\", \"storage\", {\"get_param\": \"NodeIndex\"}]}}], [{\"subnet\": \"storage_subnet\"}]]}, \"ControlPlaneSubnetCidr\": {\"str_split\": [\"/\", {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}, -1]}, \"IPPool\": {\"map_merge\": [{\"get_param\": \"StandaloneIPs\"}]}, \"NodeIndex\": {\"get_param\": \"NodeIndex\"}, \"Role\": \"Standalone\"}}, \"StorageMgmtPort\": {\"type\": \"OS::TripleO::Standalone::Ports::StorageMgmtPort\", \"properties\": {\"PortName\": {\"list_join\": [\"_\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"StorageMgmt\"]]}, \"DnsName\": {\"get_attr\": [\"Standalone\", \"name\"]}, \"ControlPlaneIP\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"FixedIPs\": {\"if\": [\"Standalone_StorageMgmt_fixed_ip_set\", [{\"ip_address\": {\"get_param\": [\"StandaloneIPs\", \"storage_mgmt\", {\"get_param\": \"NodeIndex\"}]}}], [{\"subnet\": \"storage_mgmt_subnet\"}]]}, \"ControlPlaneSubnetCidr\": {\"str_split\": [\"/\", {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}, -1]}, \"IPPool\": {\"map_merge\": [{\"get_param\": \"StandaloneIPs\"}]}, \"NodeIndex\": {\"get_param\": \"NodeIndex\"}, \"Role\": \"Standalone\"}}, \"InternalApiPort\": {\"type\": \"OS::TripleO::Standalone::Ports::InternalApiPort\", \"properties\": {\"PortName\": {\"list_join\": [\"_\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"InternalApi\"]]}, \"DnsName\": {\"get_attr\": [\"Standalone\", \"name\"]}, \"ControlPlaneIP\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"FixedIPs\": {\"if\": [\"Standalone_InternalApi_fixed_ip_set\", [{\"ip_address\": {\"get_param\": [\"StandaloneIPs\", \"internal_api\", {\"get_param\": \"NodeIndex\"}]}}], [{\"subnet\": \"internal_api_subnet\"}]]}, \"ControlPlaneSubnetCidr\": {\"str_split\": [\"/\", {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}, -1]}, \"IPPool\": {\"map_merge\": [{\"get_param\": \"StandaloneIPs\"}]}, \"NodeIndex\": {\"get_param\": \"NodeIndex\"}, \"Role\": \"Standalone\"}}, \"TenantPort\": {\"type\": \"OS::TripleO::Standalone::Ports::TenantPort\", \"properties\": {\"PortName\": {\"list_join\": [\"_\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"Tenant\"]]}, \"DnsName\": {\"get_attr\": [\"Standalone\", \"name\"]}, \"ControlPlaneIP\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"FixedIPs\": {\"if\": [\"Standalone_Tenant_fixed_ip_set\", [{\"ip_address\": {\"get_param\": [\"StandaloneIPs\", \"tenant\", {\"get_param\": \"NodeIndex\"}]}}], [{\"subnet\": \"tenant_subnet\"}]]}, \"ControlPlaneSubnetCidr\": {\"str_split\": [\"/\", {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}, -1]}, \"IPPool\": {\"map_merge\": [{\"get_param\": \"StandaloneIPs\"}]}, \"NodeIndex\": {\"get_param\": \"NodeIndex\"}, \"Role\": \"Standalone\"}}, \"ExternalPort\": {\"type\": \"OS::TripleO::Standalone::Ports::ExternalPort\", \"properties\": {\"PortName\": {\"list_join\": [\"_\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"External\"]]}, \"DnsName\": {\"get_attr\": [\"Standalone\", \"name\"]}, \"ControlPlaneIP\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"FixedIPs\": {\"if\": [\"Standalone_External_fixed_ip_set\", [{\"ip_address\": {\"get_param\": [\"StandaloneIPs\", \"external\", {\"get_param\": \"NodeIndex\"}]}}], [{\"subnet\": \"external_subnet\"}]]}, \"ControlPlaneSubnetCidr\": {\"str_split\": [\"/\", {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}, -1]}, \"IPPool\": {\"map_merge\": [{\"get_param\": \"StandaloneIPs\"}]}, \"NodeIndex\": {\"get_param\": \"NodeIndex\"}, \"Role\": \"Standalone\"}}, \"NetIpMap\": {\"type\": \"OS::TripleO::Network::Ports::NetIpMap\", \"properties\": {\"ControlPlaneIp\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"ControlPlaneSubnetCidr\": {\"str_split\": [\"/\", {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}, -1]}, \"StorageIp\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}, \"StorageIpSubnet\": {\"get_attr\": [\"StoragePort\", \"ip_subnet\"]}, \"StorageIpUri\": {\"get_attr\": [\"StoragePort\", \"ip_address_uri\"]}, \"StorageMgmtIp\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}, \"StorageMgmtIpSubnet\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_subnet\"]}, \"StorageMgmtIpUri\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address_uri\"]}, \"InternalApiIp\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}, \"InternalApiIpSubnet\": {\"get_attr\": [\"InternalApiPort\", \"ip_subnet\"]}, \"InternalApiIpUri\": {\"get_attr\": [\"InternalApiPort\", \"ip_address_uri\"]}, \"TenantIp\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}, \"TenantIpSubnet\": {\"get_attr\": [\"TenantPort\", \"ip_subnet\"]}, \"TenantIpUri\": {\"get_attr\": [\"TenantPort\", \"ip_address_uri\"]}, \"ExternalIp\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}, \"ExternalIpSubnet\": {\"get_attr\": [\"ExternalPort\", \"ip_subnet\"]}, \"ExternalIpUri\": {\"get_attr\": [\"ExternalPort\", \"ip_address_uri\"]}}}, \"NetHostMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"storage\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"storage\", {\"get_param\": \"CloudDomain\"}]]}, \"short\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"storage\"]]}}, \"storage_mgmt\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"storagemgmt\", {\"get_param\": \"CloudDomain\"}]]}, \"short\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"storagemgmt\"]]}}, \"internal_api\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"internalapi\", {\"get_param\": \"CloudDomain\"}]]}, \"short\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"internalapi\"]]}}, \"tenant\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"tenant\", {\"get_param\": \"CloudDomain\"}]]}, \"short\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"tenant\"]]}}, \"external\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"external\", {\"get_param\": \"CloudDomain\"}]]}, \"short\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"external\"]]}}, \"ctlplane\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"ctlplane\", {\"get_param\": \"CloudDomain\"}]]}, \"short\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, \"ctlplane\"]]}}, \"canonical\": {\"fqdn\": {\"list_join\": [\".\", [{\"get_attr\": [\"Standalone\", \"name\"]}, {\"get_param\": \"CloudDomain\"}]]}, \"short\": [{\"get_attr\": [\"Standalone\", \"name\"]}]}}}}, \"PreNetworkConfig\": {\"type\": \"OS::TripleO::Standalone::PreNetworkConfig\", \"condition\": \"server_not_blacklisted\", \"properties\": {\"server\": {\"get_resource\": \"Standalone\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"ServiceNames\": {\"get_param\": \"ServiceNames\"}, \"deployment_actions\": {\"get_attr\": [\"DeploymentActions\", \"value\"]}}}, \"NodeTLSCAData\": {\"type\": \"OS::TripleO::NodeTLSCAData\", \"properties\": {\"server\": {\"get_resource\": \"Standalone\"}}}, \"StandaloneExtraConfigPre\": {\"type\": \"OS::TripleO::StandaloneExtraConfigPre\", \"condition\": \"server_not_blacklisted\", \"properties\": {\"server\": {\"get_resource\": \"Standalone\"}}}, \"NodeExtraConfig\": {\"depends_on\": [\"StandaloneExtraConfigPre\", \"NodeTLSCAData\"], \"type\": \"OS::TripleO::NodeExtraConfig\", \"condition\": \"server_not_blacklisted\", \"properties\": {\"server\": {\"get_resource\": \"Standalone\"}}}, \"DeploymentActions\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"if\": [\"server_not_blacklisted\", [\"CREATE\", \"UPDATE\"], []]}}}, \"StandaloneAnsibleHostVars\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"fqdn_storage\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"fqdn\"]}, \"fqdn_storage_mgmt\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"fqdn\"]}, \"fqdn_internal_api\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"fqdn\"]}, \"fqdn_tenant\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"fqdn\"]}, \"fqdn_external\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"fqdn\"]}, \"fqdn_ctlplane\": {\"get_attr\": [\"NetHostMap\", \"value\", \"ctlplane\", \"fqdn\"]}, \"fqdn_canonical\": {\"get_attr\": [\"NetHostMap\", \"value\", \"canonical\", \"fqdn\"]}, \"hostname_resolve_network\": {\"get_param\": [\"ServiceNetMap\", \"StandaloneHostnameResolveNetwork\"]}}}}}, \"outputs\": {\"ansible_host_vars_map\": {\"description\": \"Map of Ansible variables specific per host.\\nThis map is used to construct the AnsibleHostVarsMap output for the\\nansible vars per host in config-download.\\n\", \"value\": {\"map_replace\": [{\"host\": {\"get_attr\": [\"StandaloneAnsibleHostVars\", \"value\"]}}, {\"keys\": {\"host\": {\"get_attr\": [\"Standalone\", \"name\"]}}}]}}, \"ip_address\": {\"description\": \"IP address of the server in the ctlplane network\", \"value\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}}, \"blacklist_ip_address\": {\"description\": \"IP address of the server if the server is blacklisted, otherwise this output will be an empty string\", \"value\": {\"if\": [\"server_blacklisted\", {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"\"]}}, \"blacklist_hostname\": {\"description\": \"Hostname of the server if the server is blacklisted, otherwise this output will be an empty string\", \"value\": {\"if\": [\"server_blacklisted\", {\"get_attr\": [\"Standalone\", \"name\"]}, \"\"]}}, \"hostname\": {\"description\": \"Hostname of the server\", \"value\": {\"get_attr\": [\"Standalone\", \"name\"]}}, \"hostname_map\": {\"description\": \"Mapping of network names to hostnames\", \"value\": {\"storage\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"fqdn\"]}, \"storage_mgmt\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"fqdn\"]}, \"internal_api\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"fqdn\"]}, \"tenant\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"fqdn\"]}, \"external\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"fqdn\"]}, \"ctlplane\": {\"get_attr\": [\"NetHostMap\", \"value\", \"ctlplane\", \"fqdn\"]}, \"canonical\": {\"get_attr\": [\"NetHostMap\", \"value\", \"canonical\", \"fqdn\"]}}}, \"hosts_entry\": {\"value\": [{\"str_replace\": {\"template\": \"PRIMARYIP PRIMARYHOST.DOMAIN PRIMARYHOST\", \"params\": {\"PRIMARYIP\": {\"get_attr\": [\"NetIpMap\", \"net_ip_map\", {\"get_param\": [\"ServiceNetMap\", \"StandaloneHostnameResolveNetwork\"]}]}, \"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"PRIMARYHOST\": {\"get_attr\": [\"Standalone\", \"name\"]}}}}, {\"str_replace\": {\"template\": \"StorageIP StorageHOST.DOMAIN StorageHOST\", \"params\": {\"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"StorageIP\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}, \"StorageHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"short\"]}, \"StorageMgmtIP\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}, \"StorageMgmtHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"short\"]}, \"InternalApiIP\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}, \"InternalApiHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"short\"]}, \"TenantIP\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}, \"TenantHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"short\"]}, \"ExternalIP\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}, \"ExternalHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"short\"]}}}}, {\"str_replace\": {\"template\": \"StorageMgmtIP StorageMgmtHOST.DOMAIN StorageMgmtHOST\", \"params\": {\"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"StorageIP\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}, \"StorageHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"short\"]}, \"StorageMgmtIP\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}, \"StorageMgmtHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"short\"]}, \"InternalApiIP\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}, \"InternalApiHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"short\"]}, \"TenantIP\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}, \"TenantHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"short\"]}, \"ExternalIP\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}, \"ExternalHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"short\"]}}}}, {\"str_replace\": {\"template\": \"InternalApiIP InternalApiHOST.DOMAIN InternalApiHOST\", \"params\": {\"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"StorageIP\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}, \"StorageHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"short\"]}, \"StorageMgmtIP\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}, \"StorageMgmtHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"short\"]}, \"InternalApiIP\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}, \"InternalApiHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"short\"]}, \"TenantIP\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}, \"TenantHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"short\"]}, \"ExternalIP\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}, \"ExternalHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"short\"]}}}}, {\"str_replace\": {\"template\": \"TenantIP TenantHOST.DOMAIN TenantHOST\", \"params\": {\"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"StorageIP\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}, \"StorageHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"short\"]}, \"StorageMgmtIP\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}, \"StorageMgmtHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"short\"]}, \"InternalApiIP\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}, \"InternalApiHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"short\"]}, \"TenantIP\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}, \"TenantHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"short\"]}, \"ExternalIP\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}, \"ExternalHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"short\"]}}}}, {\"str_replace\": {\"template\": \"ExternalIP ExternalHOST.DOMAIN ExternalHOST\", \"params\": {\"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"StorageIP\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}, \"StorageHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage\", \"short\"]}, \"StorageMgmtIP\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}, \"StorageMgmtHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"storage_mgmt\", \"short\"]}, \"InternalApiIP\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}, \"InternalApiHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"internal_api\", \"short\"]}, \"TenantIP\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}, \"TenantHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"tenant\", \"short\"]}, \"ExternalIP\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}, \"ExternalHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"external\", \"short\"]}}}}, {\"str_replace\": {\"template\": \"CTLPLANEIP CTLPLANEHOST.DOMAIN CTLPLANEHOST\", \"params\": {\"DOMAIN\": {\"get_param\": \"CloudDomain\"}, \"CTLPLANEIP\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}, \"CTLPLANEHOST\": {\"get_attr\": [\"NetHostMap\", \"value\", \"ctlplane\", \"short\"]}}}}]}, \"nova_server_resource\": {\"description\": \"Heat resource handle for Standalone server\", \"value\": {\"get_resource\": \"Standalone\"}, \"condition\": \"server_not_blacklisted\"}, \"deployed_server_port_map\": {\"description\": \"Map of Heat created hostname of the server to ip address. This is the\\nhostname before it has been mapped with the HostnameMap parameter, and\\nthe IP address from the ctlplane network. This map can be used to construct\\nthe DeployedServerPortMap parameter when using split-stack.\\n\", \"value\": {\"map_replace\": [{\"hostname\": {\"fixed_ips\": [{\"ip_address\": {\"get_attr\": [\"Standalone\", \"networks\", \"ctlplane\", 0]}}], \"subnets\": [{\"cidr\": {\"get_attr\": [\"Standalone\", \"addresses\", \"ctlplane\", 0, \"subnets\", 0, \"cidr\"]}}]}}, {\"keys\": {\"hostname\": {\"list_join\": [\"-\", [{\"get_param\": \"Hostname\"}, \"ctlplane\"]]}}}]}}, \"storage_ip_address\": {\"description\": \"IP address of the server in the Storage network\", \"value\": {\"get_attr\": [\"StoragePort\", \"ip_address\"]}}, \"storage_mgmt_ip_address\": {\"description\": \"IP address of the server in the StorageMgmt network\", \"value\": {\"get_attr\": [\"StorageMgmtPort\", \"ip_address\"]}}, \"internal_api_ip_address\": {\"description\": \"IP address of the server in the InternalApi network\", \"value\": {\"get_attr\": [\"InternalApiPort\", \"ip_address\"]}}, \"tenant_ip_address\": {\"description\": \"IP address of the server in the Tenant network\", \"value\": {\"get_attr\": [\"TenantPort\", \"ip_address\"]}}, \"external_ip_address\": {\"description\": \"IP address of the server in the External network\", \"value\": {\"get_attr\": [\"ExternalPort\", \"ip_address\"]}}}}", "file:///root/tripleo-heat-installer-templates/puppet/extraconfig/pre_deploy/default.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Noop Extra Pre-Deployment Config\", \"parameters\": {\"server\": {\"type\": \"string\"}}, \"outputs\": {\"deploy_stdout\": {\"value\": \"None\"}}}", "file:///root/tripleo-heat-installer-templates/network/ports/noop.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Returns the control plane port (provisioning network) as the ip_address.\\n\", \"parameters\": {\"ServiceName\": {\"description\": \"Name of the service to lookup\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"ControlPlaneMtu\": {\"default\": 1500, \"description\": \"The maximum transmission unit (MTU) size(in bytes) that is guaranteed to pass through the data path of the segments in the network. (The parameter is automatically resolved from the ctlplane network's mtu attribute.)\", \"type\": \"number\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"NetworkName\": {\"description\": \"Name of the network where the VIP will be created\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"IPPool\": {\"default\": {}, \"description\": \"A network mapped list of IPs\", \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"description\": \"Index of the IP to get from Pool\", \"type\": \"number\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"DefaultRoute\": {\"description\": \"Whether this interface is used for the default route\\n\", \"type\": \"boolean\", \"default\": false}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"outputs\": {\"ip_address\": {\"description\": \"pass thru network IP\", \"value\": {\"get_param\": \"ControlPlaneIP\"}}, \"ip_address_uri\": {\"description\": \"pass thru network IP (for compatibility with vip_v6.yaml)\", \"value\": {\"str_replace\": {\"template\": {\"make_url\": {\"host\": {\"get_param\": \"ControlPlaneIP\"}}}, \"params\": {\"//\": \"\"}}}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the pass thru network IP\", \"value\": {\"list_join\": [\"\", [{\"get_param\": \"ControlPlaneIP\"}, \"/\", {\"get_param\": \"ControlPlaneSubnetCidr\"}]]}}}}", "file:///root/tripleo-heat-installer-templates/firstboot/userdata_heat_admin.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"node_admin_username\": {\"type\": \"string\", \"default\": \"heat-admin\"}, \"node_admin_extra_ssh_keys\": {\"type\": \"comma_delimited_list\", \"default\": []}}, \"description\": \"Uses cloud-init to create an additional user with a known name, in addition to the distro-default user created by the cloud-init default.\\n\", \"resources\": {\"userdata\": {\"type\": \"OS::Heat::MultipartMime\", \"properties\": {\"parts\": [{\"config\": {\"get_resource\": \"user_config\"}}]}}, \"user_config\": {\"type\": \"OS::Heat::CloudConfig\", \"properties\": {\"cloud_config\": {\"user\": {\"get_param\": \"node_admin_username\"}, \"ssh_authorized_keys\": {\"get_param\": \"node_admin_extra_ssh_keys\"}}}}}, \"outputs\": {\"OS::stack_id\": {\"value\": {\"get_resource\": \"userdata\"}}}}", "file:///root/tripleo-heat-installer-templates/firstboot/userdata_timesync.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"NtpServer\": {\"default\": [\"0.pool.ntp.org\", \"1.pool.ntp.org\", \"2.pool.ntp.org\", \"3.pool.ntp.org\"], \"description\": \"NTP servers list. Defaulted to a set of pool.ntp.org servers in order to have a sane default for Pacemaker deployments when not configuring this parameter by default.\", \"type\": \"comma_delimited_list\"}, \"NtpPool\": {\"default\": [], \"description\": \"NTP pool list.  Defaults to [], so only NtpServer is used by default.\", \"type\": \"comma_delimited_list\"}, \"NtpService\": {\"default\": \"chrony\", \"description\": \"NTP Service to use for the timesync bootstrap.\", \"type\": \"string\"}}, \"description\": \"Uses cloud-init to bootstrap timesync configuration to ensure it is done as soon as possible. We do additional and more complex configurations as part of the deployment itself.\\n\", \"conditions\": {\"use_chrony\": {\"equals\": [{\"get_param\": \"NtpService\"}, \"chrony\"]}}, \"resources\": {\"userdata\": {\"type\": \"OS::Heat::MultipartMime\", \"properties\": {\"parts\": [{\"config\": {\"get_resource\": \"timesync_chrony\"}}, {\"config\": {\"get_resource\": \"timesync_sync\"}}]}}, \"timesync_chrony\": {\"type\": \"OS::Heat::SoftwareConfig\", \"properties\": {\"config\": {\"str_replace\": {\"template\": \"#!/bin/bash\\nif [ \\\"$service\\\" != \\\"chrony\\\" ]; then\\n  exit 0\\nfi\\nset -x\\nSERVERS=\\\"$ntp_servers\\\"\\nPOOLS=\\\"$ntp_pools\\\"\\nsystemctl is-active --quiet chronyd || systemctl start chronyd\\nfor server in $SERVERS; do\\n  chronyc add server \\\"${server}\\\" iburst\\ndone\\nfor pool in $POOLS; do\\n  chronyc add server \\\"${pool}\\\" iburst\\ndone\\nchronyc sources\\n\", \"params\": {\"$ntp_servers\": {\"list_join\": [\" \", {\"get_param\": \"NtpServer\"}]}, \"$ntp_pools\": {\"list_join\": [\" \", {\"get_param\": \"NtpPool\"}]}, \"$service\": {\"get_param\": \"NtpService\"}}}}}}, \"timesync_sync\": {\"type\": \"OS::Heat::SoftwareConfig\", \"properties\": {\"config\": {\"str_replace\": {\"template\": \"#!/bin/bash\\nset -x\\nif [ \\\"$service\\\" = \\\"chrony\\\" ]; then\\n    if command -v chronyc >/dev/null; then\\n        chronyc makestep\\n        chronyc waitsync 30\\n    else\\n        echo \\\"No chronyc available, skipping sync\\\"\\n    fi\\nelif [ \\\"$service\\\" = \\\"ntp\\\" ]; then\\n    if command -v ntpdate >/dev/null; then\\n        ntpdate -u $ntp_servers\\n    else\\n        echo \\\"No ntpdate available, skipping sync\\\"\\n    fi\\nfi\\nhwclock --systohc --utc\\n\", \"params\": {\"$service\": {\"get_param\": \"NtpService\"}, \"$ntp_servers\": {\"list_join\": [\" \", {\"get_param\": \"NtpServer\"}]}}}}}}}, \"outputs\": {\"OS::stack_id\": {\"value\": {\"get_resource\": \"userdata\"}}}}", "file:///root/tripleo-heat-installer-templates/firstboot/userdata_default.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"This is a default no-op template which provides empty user-data which can be passed to the OS::Nova::Server resources. This template can be replaced with a different implementation via the resource registry, such that deployers may customize their first-boot configuration.\\n\", \"resources\": {\"userdata\": {\"type\": \"OS::Heat::MultipartMime\"}}, \"outputs\": {\"OS::stack_id\": {\"value\": {\"get_resource\": \"userdata\"}}}}", "file:///root/tripleo-heat-installer-templates/extraconfig/post_deploy/default.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Extra Post Deployment Config\", \"parameters\": {\"servers\": {\"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}}}", "file:///root/tripleo-heat-installer-templates/network/networks.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Create networks to split out Overcloud traffic\", \"parameters\": {\"CtlplaneNetworkCidrs\": {\"type\": \"json\", \"description\": \"Cidrs for the ctlplane network.\"}, \"CtlplaneNetworkAttributes\": {\"type\": \"json\", \"default\": {}, \"description\": \"A map containing attributes of the undercloud ctlplane network and subnets. NOTE: The value for this parameter is automatically populated in the plan environment by tripleoclient.\\n\"}}, \"resources\": {\"StorageNetwork\": {\"type\": \"OS::TripleO::Network::Storage\"}, \"StorageMgmtNetwork\": {\"type\": \"OS::TripleO::Network::StorageMgmt\"}, \"InternalApiNetwork\": {\"type\": \"OS::TripleO::Network::InternalApi\"}, \"TenantNetwork\": {\"type\": \"OS::TripleO::Network::Tenant\"}, \"ExternalNetwork\": {\"type\": \"OS::TripleO::Network::External\"}, \"NetworkExtraConfig\": {\"type\": \"OS::TripleO::Network::ExtraConfig\"}}, \"outputs\": {\"net_cidr_map\": {\"value\": {\"storage\": {\"yaql\": {\"data\": {\"network_cidrs\": {\"get_attr\": [\"StorageNetwork\", \"network_cidrs\"]}, \"ctlplane_cidrs\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, \"expression\": \"switch(not isList($.data.network_cidrs) => $.data.ctlplane_cidrs, $.data.network_cidrs => $.data.network_cidrs)\"}}, \"storage_mgmt\": {\"yaql\": {\"data\": {\"network_cidrs\": {\"get_attr\": [\"StorageMgmtNetwork\", \"network_cidrs\"]}, \"ctlplane_cidrs\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, \"expression\": \"switch(not isList($.data.network_cidrs) => $.data.ctlplane_cidrs, $.data.network_cidrs => $.data.network_cidrs)\"}}, \"internal_api\": {\"yaql\": {\"data\": {\"network_cidrs\": {\"get_attr\": [\"InternalApiNetwork\", \"network_cidrs\"]}, \"ctlplane_cidrs\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, \"expression\": \"switch(not isList($.data.network_cidrs) => $.data.ctlplane_cidrs, $.data.network_cidrs => $.data.network_cidrs)\"}}, \"tenant\": {\"yaql\": {\"data\": {\"network_cidrs\": {\"get_attr\": [\"TenantNetwork\", \"network_cidrs\"]}, \"ctlplane_cidrs\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, \"expression\": \"switch(not isList($.data.network_cidrs) => $.data.ctlplane_cidrs, $.data.network_cidrs => $.data.network_cidrs)\"}}, \"external\": {\"yaql\": {\"data\": {\"network_cidrs\": {\"get_attr\": [\"ExternalNetwork\", \"network_cidrs\"]}, \"ctlplane_cidrs\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, \"expression\": \"switch(not isList($.data.network_cidrs) => $.data.ctlplane_cidrs, $.data.network_cidrs => $.data.network_cidrs)\"}}}}, \"net_ip_version_map\": {\"value\": {\"storage\": {\"get_attr\": [\"StorageNetwork\", \"ip_version\"]}, \"storage_mgmt\": {\"get_attr\": [\"StorageMgmtNetwork\", \"ip_version\"]}, \"internal_api\": {\"get_attr\": [\"InternalApiNetwork\", \"ip_version\"]}, \"tenant\": {\"get_attr\": [\"TenantNetwork\", \"ip_version\"]}, \"external\": {\"get_attr\": [\"ExternalNetwork\", \"ip_version\"]}}}, \"net_attributes_map\": {\"value\": {\"ctlplane\": {\"get_param\": \"CtlplaneNetworkAttributes\"}, \"storage\": {\"network\": {\"get_attr\": [\"StorageNetwork\", \"network_attrs\"]}, \"subnets\": {\"get_attr\": [\"StorageNetwork\", \"subnet_attrs\"]}}, \"storage_mgmt\": {\"network\": {\"get_attr\": [\"StorageMgmtNetwork\", \"network_attrs\"]}, \"subnets\": {\"get_attr\": [\"StorageMgmtNetwork\", \"subnet_attrs\"]}}, \"internal_api\": {\"network\": {\"get_attr\": [\"InternalApiNetwork\", \"network_attrs\"]}, \"subnets\": {\"get_attr\": [\"InternalApiNetwork\", \"subnet_attrs\"]}}, \"tenant\": {\"network\": {\"get_attr\": [\"TenantNetwork\", \"network_attrs\"]}, \"subnets\": {\"get_attr\": [\"TenantNetwork\", \"subnet_attrs\"]}}, \"external\": {\"network\": {\"get_attr\": [\"ExternalNetwork\", \"network_attrs\"]}, \"subnets\": {\"get_attr\": [\"ExternalNetwork\", \"subnet_attrs\"]}}}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/net_ip_map.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"ControlPlaneIp\": {\"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"StorageIp\": {\"default\": \"\", \"type\": \"string\"}, \"StorageIpSubnet\": {\"description\": \"IP address/subnet on the storage network\", \"default\": \"\", \"type\": \"string\"}, \"StorageIpUri\": {\"default\": \"\", \"type\": \"string\", \"description\": \"IP address with brackets in case of IPv6\"}, \"StorageNetName\": {\"default\": \"storage\", \"description\": \"The name of the storage network.\", \"type\": \"string\"}, \"StorageMgmtIp\": {\"default\": \"\", \"type\": \"string\"}, \"StorageMgmtIpSubnet\": {\"description\": \"IP address/subnet on the storage_mgmt network\", \"default\": \"\", \"type\": \"string\"}, \"StorageMgmtIpUri\": {\"default\": \"\", \"type\": \"string\", \"description\": \"IP address with brackets in case of IPv6\"}, \"StorageMgmtNetName\": {\"default\": \"storage_mgmt\", \"description\": \"The name of the storage_mgmt network.\", \"type\": \"string\"}, \"InternalApiIp\": {\"default\": \"\", \"type\": \"string\"}, \"InternalApiIpSubnet\": {\"description\": \"IP address/subnet on the internal_api network\", \"default\": \"\", \"type\": \"string\"}, \"InternalApiIpUri\": {\"default\": \"\", \"type\": \"string\", \"description\": \"IP address with brackets in case of IPv6\"}, \"InternalApiNetName\": {\"default\": \"internal_api\", \"description\": \"The name of the internal_api network.\", \"type\": \"string\"}, \"TenantIp\": {\"default\": \"\", \"type\": \"string\"}, \"TenantIpSubnet\": {\"description\": \"IP address/subnet on the tenant network\", \"default\": \"\", \"type\": \"string\"}, \"TenantIpUri\": {\"default\": \"\", \"type\": \"string\", \"description\": \"IP address with brackets in case of IPv6\"}, \"TenantNetName\": {\"default\": \"tenant\", \"description\": \"The name of the tenant network.\", \"type\": \"string\"}, \"ExternalIp\": {\"default\": \"\", \"type\": \"string\"}, \"ExternalIpSubnet\": {\"description\": \"IP address/subnet on the external network\", \"default\": \"\", \"type\": \"string\"}, \"ExternalIpUri\": {\"default\": \"\", \"type\": \"string\", \"description\": \"IP address with brackets in case of IPv6\"}, \"ExternalNetName\": {\"default\": \"external\", \"description\": \"The name of the external network.\", \"type\": \"string\"}}, \"resources\": {\"NetIpMapValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"ctlplane\": {\"get_param\": \"ControlPlaneIp\"}, \"ctlplane_subnet\": {\"list_join\": [\"\", [{\"get_param\": \"ControlPlaneIp\"}, \"/\", {\"get_param\": \"ControlPlaneSubnetCidr\"}]]}, \"ctlplane_uri\": {\"str_replace\": {\"template\": {\"make_url\": {\"host\": {\"get_param\": \"ControlPlaneIp\"}}}, \"params\": {\"//\": \"\"}}}, \"storage\": {\"get_param\": \"StorageIp\"}, \"storage_subnet\": {\"get_param\": \"StorageIpSubnet\"}, \"storage_uri\": {\"get_param\": \"StorageIpUri\"}, \"storage_mgmt\": {\"get_param\": \"StorageMgmtIp\"}, \"storage_mgmt_subnet\": {\"get_param\": \"StorageMgmtIpSubnet\"}, \"storage_mgmt_uri\": {\"get_param\": \"StorageMgmtIpUri\"}, \"internal_api\": {\"get_param\": \"InternalApiIp\"}, \"internal_api_subnet\": {\"get_param\": \"InternalApiIpSubnet\"}, \"internal_api_uri\": {\"get_param\": \"InternalApiIpUri\"}, \"tenant\": {\"get_param\": \"TenantIp\"}, \"tenant_subnet\": {\"get_param\": \"TenantIpSubnet\"}, \"tenant_uri\": {\"get_param\": \"TenantIpUri\"}, \"external\": {\"get_param\": \"ExternalIp\"}, \"external_subnet\": {\"get_param\": \"ExternalIpSubnet\"}, \"external_uri\": {\"get_param\": \"ExternalIpUri\"}}, {\"keys\": {\"ctlplane\": \"ctlplane\", \"storage\": {\"get_param\": \"StorageNetName\"}, \"storage_subnet\": {\"str_replace\": {\"template\": \"NAME_subnet\", \"params\": {\"NAME\": {\"get_param\": \"StorageNetName\"}}}}, \"storage_uri\": {\"str_replace\": {\"template\": \"NAME_uri\", \"params\": {\"NAME\": {\"get_param\": \"StorageNetName\"}}}}, \"storage_mgmt\": {\"get_param\": \"StorageMgmtNetName\"}, \"storage_mgmt_subnet\": {\"str_replace\": {\"template\": \"NAME_subnet\", \"params\": {\"NAME\": {\"get_param\": \"StorageMgmtNetName\"}}}}, \"storage_mgmt_uri\": {\"str_replace\": {\"template\": \"NAME_uri\", \"params\": {\"NAME\": {\"get_param\": \"StorageMgmtNetName\"}}}}, \"internal_api\": {\"get_param\": \"InternalApiNetName\"}, \"internal_api_subnet\": {\"str_replace\": {\"template\": \"NAME_subnet\", \"params\": {\"NAME\": {\"get_param\": \"InternalApiNetName\"}}}}, \"internal_api_uri\": {\"str_replace\": {\"template\": \"NAME_uri\", \"params\": {\"NAME\": {\"get_param\": \"InternalApiNetName\"}}}}, \"tenant\": {\"get_param\": \"TenantNetName\"}, \"tenant_subnet\": {\"str_replace\": {\"template\": \"NAME_subnet\", \"params\": {\"NAME\": {\"get_param\": \"TenantNetName\"}}}}, \"tenant_uri\": {\"str_replace\": {\"template\": \"NAME_uri\", \"params\": {\"NAME\": {\"get_param\": \"TenantNetName\"}}}}, \"external\": {\"get_param\": \"ExternalNetName\"}, \"external_subnet\": {\"str_replace\": {\"template\": \"NAME_subnet\", \"params\": {\"NAME\": {\"get_param\": \"ExternalNetName\"}}}}, \"external_uri\": {\"str_replace\": {\"template\": \"NAME_uri\", \"params\": {\"NAME\": {\"get_param\": \"ExternalNetName\"}}}}}}]}}}}, \"outputs\": {\"net_ip_map\": {\"description\": \"A Hash containing a mapping of network names to assigned IPs for a specific machine.\\n\", \"value\": {\"get_attr\": [\"NetIpMapValue\", \"value\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/net_ip_list_map.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"ControlPlaneIpList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"StorageIpList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"StorageNetName\": {\"default\": \"storage\", \"description\": \"The name of the storage network.\", \"type\": \"string\"}, \"StorageMgmtIpList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"StorageMgmtNetName\": {\"default\": \"storage_mgmt\", \"description\": \"The name of the storage_mgmt network.\", \"type\": \"string\"}, \"InternalApiIpList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"InternalApiNetName\": {\"default\": \"internal_api\", \"description\": \"The name of the internal_api network.\", \"type\": \"string\"}, \"TenantIpList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"TenantNetName\": {\"default\": \"tenant\", \"description\": \"The name of the tenant network.\", \"type\": \"string\"}, \"ExternalIpList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"ExternalNetName\": {\"default\": \"external\", \"description\": \"The name of the external network.\", \"type\": \"string\"}, \"EnabledServices\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"ServiceNetMap\": {\"default\": {}, \"type\": \"json\"}, \"ServiceHostnameList\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"NetworkHostnameMap\": {\"default\": [], \"type\": \"json\"}, \"NovaAdditionalCell\": {\"default\": false, \"description\": \"Whether this is an cell additional to the default cell.\", \"type\": \"boolean\"}, \"RoleNetworks\": {\"default\": \"ctlplane\", \"type\": \"comma_delimited_list\"}}, \"conditions\": {\"is_cell\": {\"equals\": [{\"get_param\": \"NovaAdditionalCell\"}, true]}}, \"resources\": {\"EnabledServicesValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"let(root => $) -> $.data.extra_services.items().where($[0] in $root.data.enabled_services).select($[1]).flatten() + $root.data.enabled_services\", \"data\": {\"enabled_services\": {\"get_param\": \"EnabledServices\"}, \"extra_services\": {\"keystone\": [\"keystone_admin_api\", \"keystone_public_api\"]}}}}}}, \"NetIpMapValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"yaql\": {\"expression\": \"let(root => $) -> dict($.data.net_ip_map.items().where($[0] in $root.data.role_networks))\", \"data\": {\"role_networks\": {\"get_param\": \"RoleNetworks\"}, \"net_ip_map\": {\"ctlplane\": {\"get_param\": \"ControlPlaneIpList\"}, \"storage\": {\"get_param\": \"StorageIpList\"}, \"storage_mgmt\": {\"get_param\": \"StorageMgmtIpList\"}, \"internal_api\": {\"get_param\": \"InternalApiIpList\"}, \"tenant\": {\"get_param\": \"TenantIpList\"}, \"external\": {\"get_param\": \"ExternalIpList\"}}}}}, {\"keys\": {\"ctlplane\": \"ctlplane\", \"storage\": {\"get_param\": \"StorageNetName\"}, \"storage_mgmt\": {\"get_param\": \"StorageMgmtNetName\"}, \"internal_api\": {\"get_param\": \"InternalApiNetName\"}, \"tenant\": {\"get_param\": \"TenantNetName\"}, \"external\": {\"get_param\": \"ExternalNetName\"}}}]}}}}, \"outputs\": {\"net_ip_map\": {\"description\": \"A Hash containing a mapping of network names to assigned lists of IP addresses.\\n\", \"value\": {\"get_attr\": [\"NetIpMapValue\", \"value\"]}}, \"ctlplane_service_ips\": {\"description\": \"Map of enabled services to a list of their ctlplane IP addresses\\n\", \"value\": {\"map_merge\": {\"repeat\": {\"template\": {\"SERVICE_ctlplane_node_ips\": \"$$ groups['SERVICE'] | default ([]) | map('extract', hostvars, 'ctlplane_ip') | list | to_json $$\"}, \"for_each\": {\"SERVICE\": {\"get_attr\": [\"EnabledServicesValue\", \"value\"]}}}}}}}}", "file:///root/tripleo-heat-installer-templates/network/service_net_map.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Mapping of service_name_network -> network name\\n\", \"parameters\": {\"ServiceNetMap\": {\"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults. Note that the key in this map must match the service_name in the service template, e.g if the service_name is heat_api the key must be either heat_api_network, or optionally HeatApiNetwork (which will be internally converted to transform captalization to underscores).\", \"type\": \"json\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"VipSubnetMap\": {\"description\": \"Map of (network_name or service_name) -> subnet_name that defines which subnet to host the VIP. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"ServiceNetMapDeprecatedMapping\": {\"default\": {\"RabbitMqNetwork\": \"RabbitmqNetwork\", \"CephPublicNetwork\": \"CephMonNetwork\", \"SwiftMgmtNetwork\": \"SwiftStorageNetwork\"}, \"description\": \"Mapping older deprecated service names, intended for internal use only, this will be removed in future.\", \"type\": \"json\"}, \"StorageNetName\": {\"default\": \"storage\", \"description\": \"The name of the storage network.\", \"type\": \"string\"}, \"StorageMgmtNetName\": {\"default\": \"storage_mgmt\", \"description\": \"The name of the storage_mgmt network.\", \"type\": \"string\"}, \"InternalApiNetName\": {\"default\": \"internal_api\", \"description\": \"The name of the internal_api network.\", \"type\": \"string\"}, \"TenantNetName\": {\"default\": \"tenant\", \"description\": \"The name of the tenant network.\", \"type\": \"string\"}, \"ExternalNetName\": {\"default\": \"external\", \"description\": \"The name of the external network.\", \"type\": \"string\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"Do not use deprecated params, they will be removed.\", \"parameters\": [\"ServiceNetMapDeprecatedMapping\"]}], \"resources\": {\"ServiceNetMapValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_merge\": [{\"map_replace\": [{\"get_param\": \"ServiceNetMap\"}, {\"values\": {\"storage\": {\"get_param\": \"StorageNetName\"}, \"storage_mgmt\": {\"get_param\": \"StorageMgmtNetName\"}, \"internal_api\": {\"get_param\": \"InternalApiNetName\"}, \"tenant\": {\"get_param\": \"TenantNetName\"}, \"external\": {\"get_param\": \"ExternalNetName\"}}, \"keys\": {\"get_param\": \"ServiceNetMapDeprecatedMapping\"}}]}, {\"NovaVncProxyNetwork\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}]}}}}, \"outputs\": {\"service_net_map\": {\"value\": {\"get_attr\": [\"ServiceNetMapValue\", \"value\"]}}, \"service_net_map_lower\": {\"value\": {\"yaql\": {\"expression\": \"dict($.data.map.items().select([ regex(`([a-z0-9])([A-Z])`).replace($[0], '\\\\\\\\1_\\\\\\\\2').toLower(), $[1]]))\", \"data\": {\"map\": {\"get_attr\": [\"ServiceNetMapValue\", \"value\"]}}}}}, \"vip_subnet_map\": {\"value\": {\"map_replace\": [{\"get_param\": \"VipSubnetMap\"}, {\"values\": {\"ctlplane-subnet\": {\"get_param\": \"ControlPlaneSubnet\"}}}]}}}}", "file:///root/tripleo-heat-installer-templates/network/endpoints/endpoint_map.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"A map of OpenStack endpoints. Since the endpoints are URLs, we need to have brackets around IPv6 IP addresses. The inputs to these parameters come from net_ip_uri_map, which will include these brackets in IPv6 addresses.\", \"parameters\": {\"NetIpMap\": {\"type\": \"json\", \"default\": {}, \"description\": \"The Net IP map\"}, \"ServiceNetMap\": {\"type\": \"json\", \"default\": {}, \"description\": \"The Service Net map\"}, \"EndpointMap\": {\"type\": \"json\", \"default\": {\"AodhAdmin\": {\"protocol\": \"http\", \"port\": \"8042\", \"host\": \"IP_ADDRESS\"}, \"AodhInternal\": {\"protocol\": \"http\", \"port\": \"8042\", \"host\": \"IP_ADDRESS\"}, \"AodhPublic\": {\"protocol\": \"http\", \"port\": \"8042\", \"host\": \"IP_ADDRESS\"}, \"BarbicanAdmin\": {\"protocol\": \"http\", \"port\": \"9311\", \"host\": \"IP_ADDRESS\"}, \"BarbicanInternal\": {\"protocol\": \"http\", \"port\": \"9311\", \"host\": \"IP_ADDRESS\"}, \"BarbicanPublic\": {\"protocol\": \"http\", \"port\": \"9311\", \"host\": \"IP_ADDRESS\"}, \"CephDashboardInternal\": {\"protocol\": \"http\", \"port\": \"8444\", \"host\": \"IP_ADDRESS\"}, \"CephGrafanaInternal\": {\"protocol\": \"http\", \"port\": \"3100\", \"host\": \"IP_ADDRESS\"}, \"CephRgwAdmin\": {\"protocol\": \"http\", \"port\": \"8080\", \"host\": \"IP_ADDRESS\"}, \"CephRgwInternal\": {\"protocol\": \"http\", \"port\": \"8080\", \"host\": \"IP_ADDRESS\"}, \"CephRgwPublic\": {\"protocol\": \"http\", \"port\": \"8080\", \"host\": \"IP_ADDRESS\"}, \"CinderAdmin\": {\"protocol\": \"http\", \"port\": \"8776\", \"host\": \"IP_ADDRESS\"}, \"CinderInternal\": {\"protocol\": \"http\", \"port\": \"8776\", \"host\": \"IP_ADDRESS\"}, \"CinderPublic\": {\"protocol\": \"http\", \"port\": \"8776\", \"host\": \"IP_ADDRESS\"}, \"DesignateAdmin\": {\"protocol\": \"http\", \"port\": \"9001\", \"host\": \"IP_ADDRESS\"}, \"DesignateInternal\": {\"protocol\": \"http\", \"port\": \"9001\", \"host\": \"IP_ADDRESS\"}, \"DesignatePublic\": {\"protocol\": \"http\", \"port\": \"9001\", \"host\": \"IP_ADDRESS\"}, \"DockerRegistryInternal\": {\"protocol\": \"http\", \"port\": \"8787\", \"host\": \"IP_ADDRESS\"}, \"GaneshaInternal\": {\"protocol\": \"nfs\", \"port\": \"2049\", \"host\": \"IP_ADDRESS\"}, \"GlanceAdmin\": {\"protocol\": \"http\", \"port\": \"9293\", \"host\": \"IP_ADDRESS\"}, \"GlanceInternal\": {\"protocol\": \"http\", \"port\": \"9293\", \"host\": \"IP_ADDRESS\"}, \"GlancePublic\": {\"protocol\": \"http\", \"port\": \"9292\", \"host\": \"IP_ADDRESS\"}, \"GnocchiAdmin\": {\"protocol\": \"http\", \"port\": \"8041\", \"host\": \"IP_ADDRESS\"}, \"GnocchiInternal\": {\"protocol\": \"http\", \"port\": \"8041\", \"host\": \"IP_ADDRESS\"}, \"GnocchiPublic\": {\"protocol\": \"http\", \"port\": \"8041\", \"host\": \"IP_ADDRESS\"}, \"HeatAdmin\": {\"protocol\": \"http\", \"port\": \"8004\", \"host\": \"IP_ADDRESS\"}, \"HeatInternal\": {\"protocol\": \"http\", \"port\": \"8004\", \"host\": \"IP_ADDRESS\"}, \"HeatPublic\": {\"protocol\": \"http\", \"port\": \"8004\", \"host\": \"IP_ADDRESS\"}, \"HeatCfnAdmin\": {\"protocol\": \"http\", \"port\": \"8000\", \"host\": \"IP_ADDRESS\"}, \"HeatCfnInternal\": {\"protocol\": \"http\", \"port\": \"8000\", \"host\": \"IP_ADDRESS\"}, \"HeatCfnPublic\": {\"protocol\": \"http\", \"port\": \"8000\", \"host\": \"IP_ADDRESS\"}, \"HorizonPublic\": {\"protocol\": \"http\", \"port\": \"80\", \"host\": \"IP_ADDRESS\"}, \"IronicAdmin\": {\"protocol\": \"http\", \"port\": \"6385\", \"host\": \"IP_ADDRESS\"}, \"IronicInternal\": {\"protocol\": \"http\", \"port\": \"6385\", \"host\": \"IP_ADDRESS\"}, \"IronicPublic\": {\"protocol\": \"http\", \"port\": \"6385\", \"host\": \"IP_ADDRESS\"}, \"IronicInspectorAdmin\": {\"protocol\": \"http\", \"port\": \"5050\", \"host\": \"IP_ADDRESS\"}, \"IronicInspectorInternal\": {\"protocol\": \"http\", \"port\": \"5050\", \"host\": \"IP_ADDRESS\"}, \"IronicInspectorPublic\": {\"protocol\": \"http\", \"port\": \"5050\", \"host\": \"IP_ADDRESS\"}, \"KeystoneAdmin\": {\"protocol\": \"http\", \"port\": \"35357\", \"host\": \"IP_ADDRESS\"}, \"KeystoneInternal\": {\"protocol\": \"http\", \"port\": \"5000\", \"host\": \"IP_ADDRESS\"}, \"KeystonePublic\": {\"protocol\": \"http\", \"port\": \"5000\", \"host\": \"IP_ADDRESS\"}, \"ManilaAdmin\": {\"protocol\": \"http\", \"port\": \"8786\", \"host\": \"IP_ADDRESS\"}, \"ManilaInternal\": {\"protocol\": \"http\", \"port\": \"8786\", \"host\": \"IP_ADDRESS\"}, \"ManilaPublic\": {\"protocol\": \"http\", \"port\": \"8786\", \"host\": \"IP_ADDRESS\"}, \"MetricsQdrPublic\": {\"protocol\": \"amqp\", \"port\": \"5666\", \"host\": \"IP_ADDRESS\"}, \"MysqlInternal\": {\"protocol\": \"mysql+pymysql\", \"port\": \"3306\", \"host\": \"IP_ADDRESS\"}, \"NeutronAdmin\": {\"protocol\": \"http\", \"port\": \"9696\", \"host\": \"IP_ADDRESS\"}, \"NeutronInternal\": {\"protocol\": \"http\", \"port\": \"9696\", \"host\": \"IP_ADDRESS\"}, \"NeutronPublic\": {\"protocol\": \"http\", \"port\": \"9696\", \"host\": \"IP_ADDRESS\"}, \"NovaAdmin\": {\"protocol\": \"http\", \"port\": \"8774\", \"host\": \"IP_ADDRESS\"}, \"NovaInternal\": {\"protocol\": \"http\", \"port\": \"8774\", \"host\": \"IP_ADDRESS\"}, \"NovaPublic\": {\"protocol\": \"http\", \"port\": \"8774\", \"host\": \"IP_ADDRESS\"}, \"NovaMetadataInternal\": {\"protocol\": \"http\", \"port\": \"8775\", \"host\": \"IP_ADDRESS\"}, \"NovaVNCProxyAdmin\": {\"protocol\": \"http\", \"port\": \"6080\", \"host\": \"IP_ADDRESS\"}, \"NovaVNCProxyInternal\": {\"protocol\": \"http\", \"port\": \"6080\", \"host\": \"IP_ADDRESS\"}, \"NovaVNCProxyPublic\": {\"protocol\": \"http\", \"port\": \"6080\", \"host\": \"IP_ADDRESS\"}, \"NovajoinAdmin\": {\"protocol\": \"http\", \"port\": \"9090\", \"host\": \"IP_ADDRESS\"}, \"NovajoinInternal\": {\"protocol\": \"http\", \"port\": \"9090\", \"host\": \"IP_ADDRESS\"}, \"NovajoinPublic\": {\"protocol\": \"http\", \"port\": \"9090\", \"host\": \"IP_ADDRESS\"}, \"OctaviaAdmin\": {\"protocol\": \"http\", \"port\": \"9876\", \"host\": \"IP_ADDRESS\"}, \"OctaviaInternal\": {\"protocol\": \"http\", \"port\": \"9876\", \"host\": \"IP_ADDRESS\"}, \"OctaviaPublic\": {\"protocol\": \"http\", \"port\": \"9876\", \"host\": \"IP_ADDRESS\"}, \"PlacementAdmin\": {\"protocol\": \"http\", \"port\": \"8778\", \"host\": \"IP_ADDRESS\"}, \"PlacementInternal\": {\"protocol\": \"http\", \"port\": \"8778\", \"host\": \"IP_ADDRESS\"}, \"PlacementPublic\": {\"protocol\": \"http\", \"port\": \"8778\", \"host\": \"IP_ADDRESS\"}, \"SwiftAdmin\": {\"protocol\": \"http\", \"port\": \"8080\", \"host\": \"IP_ADDRESS\"}, \"SwiftInternal\": {\"protocol\": \"http\", \"port\": \"8080\", \"host\": \"IP_ADDRESS\"}, \"SwiftPublic\": {\"protocol\": \"http\", \"port\": \"8080\", \"host\": \"IP_ADDRESS\"}}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\"}, \"CloudEndpoints\": {\"type\": \"json\", \"default\": {}, \"description\": \"A map containing the DNS names for the different endpoints (external, internal_api, etc.)\"}}, \"outputs\": {\"endpoint_map\": {\"value\": {\"AodhAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"port\"]}}}}, \"AodhInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"port\"]}}}}, \"AodhPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"port\"]}}}}, \"BarbicanAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"port\"]}}}}, \"BarbicanInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"port\"]}}}}, \"BarbicanPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"port\"]}}}}, \"CephDashboardInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephDashboardInternal\", \"port\"]}}}}, \"CephGrafanaInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephGrafanaNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephGrafanaInternal\", \"port\"]}}}}, \"CephRgwAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"port\"]}, \"path\": \"/swift/v1/AUTH_\"}}, \"%(project_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwAdmin\", \"port\"]}}}}, \"CephRgwInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"port\"]}, \"path\": \"/swift/v1/AUTH_\"}}, \"%(project_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephRgwNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwInternal\", \"port\"]}}}}, \"CephRgwPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"port\"]}, \"path\": \"/swift/v1/AUTH_\"}}, \"%(project_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CephRgwPublic\", \"port\"]}}}}, \"CinderAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}}}}, \"CinderInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}}}}, \"CinderPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}}}}, \"CinderV2Admin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}, \"path\": \"/v2/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}}}}, \"CinderV2Internal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}, \"path\": \"/v2/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}}}}, \"CinderV2Public\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}, \"path\": \"/v2/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}}}}, \"CinderV3Admin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}, \"path\": \"/v3/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderAdmin\", \"port\"]}}}}, \"CinderV3Internal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}, \"path\": \"/v3/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderInternal\", \"port\"]}}}}, \"CinderV3Public\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}, \"path\": \"/v3/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"CinderPublic\", \"port\"]}}}}, \"DesignateAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"port\"]}, \"path\": \"/v2\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignateAdmin\", \"port\"]}}}}, \"DesignateInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"port\"]}, \"path\": \"/v2\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DesignateApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignateInternal\", \"port\"]}}}}, \"DesignatePublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"port\"]}, \"path\": \"/v2\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DesignatePublic\", \"port\"]}}}}, \"DockerRegistryInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"DockerRegistryNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"port\"]}}}}, \"GaneshaInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GaneshaNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GaneshaInternal\", \"port\"]}}}}, \"GlanceAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"port\"]}}}}, \"GlanceInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}}}}, \"GlancePublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"port\"]}}}}, \"GnocchiAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"port\"]}}}}, \"GnocchiInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"port\"]}}}}, \"GnocchiPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"port\"]}}}}, \"HeatAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"port\"]}}}}, \"HeatInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"port\"]}}}}, \"HeatPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"port\"]}}}}, \"HeatCfnAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"port\"]}}}}, \"HeatCfnInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"port\"]}}}}, \"HeatCfnPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"port\"]}}}}, \"HorizonPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"port\"]}, \"path\": \"/dashboard\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"HorizonPublic\", \"port\"]}}}}, \"IronicAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicAdmin\", \"port\"]}}}}, \"IronicInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInternal\", \"port\"]}}}}, \"IronicPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicPublic\", \"port\"]}}}}, \"IronicInspectorAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorAdmin\", \"port\"]}}}}, \"IronicInspectorInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"IronicInspectorNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorInternal\", \"port\"]}}}}, \"IronicInspectorPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"IronicInspectorPublic\", \"port\"]}}}}, \"KeystoneAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}, \"path\": \"/\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}}}}, \"KeystoneInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"port\"]}, \"path\": \"/\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"port\"]}}}}, \"KeystonePublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"port\"]}, \"path\": \"/\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"port\"]}}}}, \"KeystoneV3Admin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}, \"path\": \"/v3\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}}}}, \"KeystoneV3Internal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"port\"]}, \"path\": \"/v3\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"port\"]}}}}, \"KeystoneV3Public\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"port\"]}, \"path\": \"/v3\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"port\"]}}}}, \"ManilaAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"port\"]}, \"path\": \"/v2\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"port\"]}}}}, \"ManilaInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"port\"]}, \"path\": \"/v2\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"port\"]}}}}, \"ManilaPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"port\"]}, \"path\": \"/v2\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"port\"]}}}}, \"ManilaV1Admin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"port\"]}}}}, \"ManilaV1Internal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"port\"]}}}}, \"ManilaV1Public\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"port\"]}, \"path\": \"/v1/\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"port\"]}}}}, \"MetricsQdrPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"MetricsQdrPublic\", \"port\"]}}}}, \"MysqlInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"port\"]}}}}, \"NeutronAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"port\"]}}}}, \"NeutronInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"port\"]}}}}, \"NeutronPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"port\"]}}}}, \"NovaAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"port\"]}, \"path\": \"/v2.1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"port\"]}}}}, \"NovaInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"port\"]}, \"path\": \"/v2.1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"port\"]}}}}, \"NovaPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"port\"]}, \"path\": \"/v2.1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"port\"]}}}}, \"NovaMetadataInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataInternal\", \"port\"]}}}}, \"NovaVNCProxyAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyAdmin\", \"port\"]}}}}, \"NovaVNCProxyInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyInternal\", \"port\"]}}}}, \"NovaVNCProxyPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyPublic\", \"port\"]}}}}, \"NovajoinAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinAdmin\", \"port\"]}}}}, \"NovajoinInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovajoinNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinInternal\", \"port\"]}}}}, \"NovajoinPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"port\"]}, \"path\": \"/v1\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"NovajoinPublic\", \"port\"]}}}}, \"OctaviaAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"port\"]}}}}, \"OctaviaInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"port\"]}}}}, \"OctaviaPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"port\"]}}}}, \"PlacementAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"port\"]}, \"path\": \"/placement\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"port\"]}}}}, \"PlacementInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"port\"]}, \"path\": \"/placement\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"port\"]}}}}, \"PlacementPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"port\"]}, \"path\": \"/placement\"}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"port\"]}}}}, \"SwiftAdmin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"port\"]}}}}, \"SwiftInternal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}, \"path\": \"/v1/AUTH_\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}}}}, \"SwiftPublic\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"protocol\"]}, \"uri\": {\"list_join\": [\"\", [{\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"port\"]}, \"path\": \"/v1/AUTH_\"}}, \"%(tenant_id)s\"]]}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"port\"]}}}}, \"SwiftS3Admin\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"port\"]}}}}, \"SwiftS3Internal\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}}}}, \"SwiftS3Public\": {\"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"host_nobrackets\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"port\"]}, \"protocol\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"protocol\"]}, \"uri\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"port\"]}}}, \"uri_no_suffix\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"protocol\"]}, \"host\": {\"str_replace\": {\"template\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"host\"]}, \"params\": {\"CLOUDNAME\": {\"get_param\": [\"CloudEndpoints\", {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}]}, \"IP_ADDRESS\": {\"get_param\": [\"NetIpMap\", {\"str_replace\": {\"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PublicNetwork\"]}}, \"template\": \"NETWORK_uri\"}}]}}}}, \"port\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"port\"]}}}}}}}}", "file:///root/tripleo-heat-installer-templates/common/services/standalone-role.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Utility stack to convert an array of services into a set of combined role configs.\\n\", \"parameters\": {\"Services\": {\"default\": [], \"description\": \"List nested stack service templates.\\n\", \"type\": \"comma_delimited_list\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"description\": \"Parameters specific to the role\", \"default\": {}, \"type\": \"json\"}}, \"resources\": {\"ServiceChain\": {\"type\": \"OS::Heat::ResourceChain\", \"properties\": {\"resources\": {\"get_param\": \"Services\"}, \"concurrent\": true, \"resource_properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"ServiceServerMetadataHook\": {\"type\": \"OS::TripleO::StandaloneServiceServerMetadataHook\", \"properties\": {\"RoleData\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}, \"PuppetStepConfig\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"string\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data.service_names, []).zip(coalesce($.data.step_config, []), coalesce($.data.docker_config, [])).where($[2] = null).where($[1] != null).select($[1]).join(\\\"\\\\n\\\")\", \"data\": {\"service_names\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"service_name\"]}, \"step_config\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"step_config\"]}, \"docker_config\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"docker_config\"]}}}}}}, \"DockerConfig\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data.service_names, []).zip(coalesce($.data.docker_config, [])).where($[1] != null).select($[1]).reduce($1.mergeWith($2), {})\", \"data\": {\"service_names\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"service_names\"]}, \"docker_config\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"docker_config\"]}}}}}}, \"DockerConfigScripts\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data.service_names, []).zip(coalesce($.data.container_config_scripts, [])).where($[1] != null).select($[1]).reduce($1.mergeWith($2), {})\", \"data\": {\"service_names\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"service_names\"]}, \"container_config_scripts\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"container_config_scripts\"]}}}}}}, \"MonitoringSubscriptionsConfig\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('monitoring_subscription')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}, \"ServiceNames\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"filter\": [[null], {\"get_attr\": [\"ServiceChain\", \"role_data\", \"service_name\"]}]}}}, \"GlobalConfigSettings\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('global_config_settings')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}}, \"KeystoneResourcesConfigs\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('keystone_resources')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}}, \"ServiceConfigSettings\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data.role_data, []).where($ != null).select($.get('service_config_settings')).where($ != null).reduce($1.mergeWith($2), {})\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}, \"DeployStepsTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('deploy_steps_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ExternalDeployTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('external_deploy_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ExternalPostDeployTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('external_post_deploy_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ScaleTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('scale_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ExternalUpdateTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('external_update_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ExternalUpgradeTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('external_upgrade_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"PreUpgradeRollingTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('pre_upgrade_rolling_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"UpgradeTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('upgrade_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"PostUpgradeTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('post_upgrade_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"UpdateTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('update_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"PostUpdateTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('post_update_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"UpgradeBatchTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('upgrade_batch_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"PuppetConfig\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('puppet_config')).where($ != null).distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"KollaConfig\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data.role_data, []).where($ != null).select($.get('kolla_config')).where($ != null).reduce($1.mergeWith($2), {})\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}, \"DockerPuppetTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"yaql\": {\"expression\": \"dict(coalesce($.data, []).where($ != null).select([$.get('docker_puppet_tasks'), $.get('service_name')]).where($[0] != null).select([$[0], dict($[0].keys().zip(dict(service_name=>$[1]).repeat(len($[0].keys()))))]).select($[0].mergeWith($[1])).selectMany($.items()).groupBy($[0], $[1]))\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ContainerPuppetTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"yaql\": {\"expression\": \"dict(coalesce($.data, []).where($ != null).select([$.get('container_puppet_tasks'), $.get('service_name')]).where($[0] != null).select([$[0], dict($[0].keys().zip(dict(service_name=>$[1]).repeat(len($[0].keys()))))]).select($[0].mergeWith($[1])).selectMany($.items()).groupBy($[0], $[1]))\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"HostFirewallTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('host_firewall_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"HostPrepTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('host_prep_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"PreDeployStepTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('pre_deploy_step_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"IpaRegistrationTasks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"comma_delimited_list\", \"value\": {\"yaql\": {\"expression\": \"coalesce($.data, []).where($ != null).select($.get('ipa_registration_tasks')).where($ != null).flatten().distinct()\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"AnsibleGroupVars\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('ansible_group_vars')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}}, \"FirewallRules\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('firewall_rules')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}}, \"FirewallFrontendRules\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"frontend\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('firewall_frontend_rules')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"ssl_frontend\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('firewall_ssl_frontend_rules')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"edge_frontend\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('firewall_edge_frontend_rules')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}, \"edge_sslfrontend\": {\"map_merge\": {\"yaql\": {\"expression\": \"list(coalesce($.data.role_data, []).where($ != null).select($.get('firewall_edge_ssl_frontend_rules')).where($ != null)).flatten()\", \"data\": {\"role_data\": {\"get_attr\": [\"ServiceChain\", \"role_data\"]}}}}}}}}}, \"outputs\": {\"role_data\": {\"description\": \"Combined Role data for this set of services.\", \"value\": {\"service_names\": {\"get_attr\": [\"ServiceNames\", \"value\"]}, \"monitoring_subscriptions\": {\"get_attr\": [\"MonitoringSubscriptionsConfig\", \"value\"]}, \"config_settings\": {\"yaql\": {\"expression\": \"$.data.where($ != null).reduce($1.mergeWith($2), {})\", \"data\": {\"get_attr\": [\"ServiceChain\", \"role_data\", \"config_settings\"]}}}, \"global_config_settings\": {\"get_attr\": [\"GlobalConfigSettings\", \"value\"]}, \"service_config_settings\": {\"get_attr\": [\"ServiceConfigSettings\", \"value\"]}, \"step_config\": {\"get_attr\": [\"PuppetStepConfig\", \"value\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"DeployStepsTasks\", \"value\"]}, \"external_deploy_tasks\": {\"get_attr\": [\"ExternalDeployTasks\", \"value\"]}, \"external_post_deploy_tasks\": {\"get_attr\": [\"ExternalPostDeployTasks\", \"value\"]}, \"external_update_tasks\": {\"get_attr\": [\"ExternalUpdateTasks\", \"value\"]}, \"external_upgrade_tasks\": {\"get_attr\": [\"ExternalUpgradeTasks\", \"value\"]}, \"scale_tasks\": {\"get_attr\": [\"ScaleTasks\", \"value\"]}, \"pre_upgrade_rolling_tasks\": {\"get_attr\": [\"PreUpgradeRollingTasks\", \"value\"]}, \"upgrade_tasks\": {\"get_attr\": [\"UpgradeTasks\", \"value\"]}, \"post_upgrade_tasks\": {\"get_attr\": [\"PostUpgradeTasks\", \"value\"]}, \"update_tasks\": {\"get_attr\": [\"UpdateTasks\", \"value\"]}, \"post_update_tasks\": {\"get_attr\": [\"PostUpdateTasks\", \"value\"]}, \"upgrade_batch_tasks\": {\"get_attr\": [\"UpgradeBatchTasks\", \"value\"]}, \"service_metadata_settings\": {\"get_attr\": [\"ServiceServerMetadataHook\", \"metadata\"]}, \"ansible_group_vars\": {\"map_merge\": [{\"ansible_async_dir\": \"/tmp/.ansible_async\"}, {\"get_attr\": [\"AnsibleGroupVars\", \"value\"]}]}, \"keystone_resources\": {\"get_attr\": [\"KeystoneResourcesConfigs\", \"value\"]}, \"firewall_rules\": {\"get_attr\": [\"FirewallRules\", \"value\"]}, \"firewall_frontend_rules\": {\"get_attr\": [\"FirewallFrontendRules\", \"value\", \"frontend\"]}, \"firewall_ssl_frontend_rules\": {\"get_attr\": [\"FirewallFrontendRules\", \"value\", \"ssl_frontend\"]}, \"firewall_edge_frontend_rules\": {\"get_attr\": [\"FirewallFrontendRules\", \"value\", \"edge_frontend\"]}, \"firewall_edge_ssl_frontend_rules\": {\"get_attr\": [\"FirewallFrontendRules\", \"value\", \"edge_ssl_frontend\"]}, \"puppet_config\": {\"get_attr\": [\"PuppetConfig\", \"value\"]}, \"kolla_config\": {\"get_attr\": [\"KollaConfig\", \"value\"]}, \"docker_config\": {\"get_attr\": [\"DockerConfig\", \"value\"]}, \"container_config_scripts\": {\"get_attr\": [\"DockerConfigScripts\", \"value\"]}, \"container_puppet_tasks\": {\"map_merge\": [{\"get_attr\": [\"ContainerPuppetTasks\", \"value\"]}, {\"get_attr\": [\"DockerPuppetTasks\", \"value\"]}]}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"HostFirewallTasks\", \"value\"]}, {\"get_attr\": [\"HostPrepTasks\", \"value\"]}]}, \"pre_deploy_step_tasks\": {\"list_concat\": [{\"get_attr\": [\"PreDeployStepTasks\", \"value\"]}, {\"get_attr\": [\"IpaRegistrationTasks\", \"value\"]}]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Apache service configured with Puppet. Note this is typically included automatically via other services which run via Apache.\\n\", \"parameters\": {\"ApacheMaxRequestWorkers\": {\"default\": 256, \"description\": \"Maximum number of simultaneously processed requests.\", \"type\": \"number\"}, \"ApacheServerLimit\": {\"default\": 256, \"description\": \"Maximum number of Apache processes.\", \"type\": \"number\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"ApacheCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"ApacheTimeout\": {\"type\": \"number\", \"default\": 90, \"description\": \"The timeout in seconds for Apache, which defines duration Apache waits for I/O operations\"}}, \"conditions\": {\"key_size_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"ApacheCertificateKeySize\"}, \"\"]}}}, \"resources\": {\"ApacheNetworks\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"Standalone\": [\"ctlplane\", \"storage\", \"storage_mgmt\", \"internal_api\", \"external\"]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Apache role.\", \"value\": {\"service_name\": \"apache\", \"config_settings\": {\"map_merge\": [{\"apache::ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ApacheNetwork\"]}}}}, \"apache::default_vhost\": false, \"apache::trace_enable\": \"Off\", \"apache::server_signature\": \"Off\", \"apache::server_tokens\": \"Prod\", \"apache::timeout\": {\"get_param\": \"ApacheTimeout\"}, \"apache::default_mods\": false, \"apache::mod::prefork::maxrequestworkers\": {\"get_param\": \"ApacheMaxRequestWorkers\"}, \"apache::mod::prefork::serverlimit\": {\"get_param\": \"ApacheServerLimit\"}, \"apache::mod::remoteip::proxy_ips\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"ApacheNetwork\"]}]}, \"apache::mod::alias::icons_options\": \"None\"}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"apache::mod::ssl::ssl_ca\": {\"get_param\": \"InternalTLSCAFile\"}, \"apache::mod::ssl::ssl_protocol\": [\"all\", \"-SSLv2\", \"-SSLv3\", \"-TLSv1\"], \"apache_certificates_specs\": {\"map_merge\": {\"repeat\": {\"template\": {\"httpd-NETWORK\": {\"service_certificate\": \"/etc/pki/tls/certs/httpd/httpd-NETWORK.crt\", \"service_key\": \"/etc/pki/tls/private/httpd/httpd-NETWORK.key\"}}, \"for_each\": {\"NETWORK\": {\"get_attr\": [\"ApacheNetworks\", \"value\", {\"get_param\": \"RoleName\"}]}}}}}}]}]}, \"metadata_settings\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"repeat\": {\"template\": [{\"service\": \"HTTP\", \"network\": \"$NETWORK\", \"type\": \"node\"}], \"for_each\": {\"$NETWORK\": {\"get_attr\": [\"ApacheNetworks\", \"value\", {\"get_param\": \"RoleName\"}]}}}}]}, \"upgrade_tasks\": [], \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"name\": \"Create dirs for certificates and keys\", \"file\": {\"path\": \"{{ item }}\", \"state\": \"directory\", \"serole\": \"object_r\", \"setype\": \"cert_t\", \"seuser\": \"system_u\"}, \"with_items\": [\"/etc/pki/tls/certs/httpd\", \"/etc/pki/tls/private/httpd\"]}, {\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": {\"repeat\": {\"template\": {\"name\": \"httpd-NETWORK\", \"dns\": \"{{ fqdn_NETWORK }}\", \"principal\": \"HTTP/{{ fqdn_NETWORK }}@{{ idm_realm }}\", \"run_after\": \"cp /etc/pki/tls/certs/httpd-NETWORK.crt /etc/pki/tls/certs/httpd/httpd-NETWORK.crt\\ncp /etc/pki/tls/private/httpd-NETWORK.key /etc/pki/tls/private/httpd/httpd-NETWORK.key\\npkill -USR1 httpd\\n\", \"key_size\": {\"if\": [\"key_size_override_set\", {\"get_param\": \"ApacheCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, \"for_each\": {\"NETWORK\": {\"get_attr\": [\"ApacheNetworks\", \"value\", {\"get_param\": \"RoleName\"}]}}}}}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/certs/ca-certs-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"HAproxy service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CAMap\": {\"description\": \"Map containing the CA certs and information needed for deploying them.\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for injecting CA certificates.\", \"value\": {\"service_name\": \"ca_certs\", \"config_settings\": {\"tripleo::trusted_cas::ca_map\": {\"get_param\": \"CAMap\"}}, \"step_config\": \"include tripleo::trusted_cas\"}}}}", "file:///root/tripleo-heat-installer-templates/container_config_scripts/pyshim.sh": "#!/usr/bin/bash\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n#\n# Usage: pyshim.sh <script and/or arguments>\n#\n# Unfortunately THT doesn't know which version of python might be in a\n# container so we need this script to be able to try python3 or python2\n# depending on availability.  Since this is a temporary shim until we've\n# fully cut over to python3, we check for the existence of python3 first\n# before falling back to python2. This will help in the transition from\n# python2 based containers to python3.\n\nshow_usage() {\n    echo \"Usage: pyshim.sh <script and/or arguments>\"\n}\n\nif [ $# -lt 1 ]\nthen\n    show_usage\n    exit 1\nfi\n\nset -x\nif command -v python3 >/dev/null; then\n    python3 \"$@\"\nelif command -v python2 >/dev/null; then\n    python2 \"$@\"\nelif command -v python >/dev/null; then\n    python \"$@\"\nelse\n    echo \"ERROR: python is not available!\"\n    exit 1\nfi\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_restart_bundle.sh": "#!/usr/bin/bash\n\nset -u\n\n# ./pacemaker_restart_bundle.sh mysql galera galera-bundle Master _\n# ./pacemaker_restart_bundle.sh redis redis redis-bundle Slave Master\n# ./pacemaker_restart_bundle.sh ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\nRESTART_SCRIPTS_DIR=$(dirname $0)\nTRIPLEO_SERVICE=$1\nRESOURCE_NAME=$2\nBUNDLE_NAME=$3\nWAIT_TARGET_LOCAL=$4\nWAIT_TARGET_ANYWHERE=${5:-_}\nTRIPLEO_MINOR_UPDATE=\"${TRIPLEO_MINOR_UPDATE:-false}\"\nTRIPLEO_HA_WRAPPER_RESOURCE_EXISTS=\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS:-false}\"\n\nbundle_can_be_restarted() {\n    local bundle=$1\n    # As long as the resource bundle is managed by pacemaker and is\n    # not meant to stay stopped, no matter the state of any inner\n    # pcmk_remote or ocf resource, we should restart it to give it a\n    # chance to read the new config.\n    [ \"$(crm_resource --meta -r $1 -g is-managed 2>/dev/null)\" != \"false\" ] && \\\n    [ \"$(crm_resource --meta -r $1 -g target-role 2>/dev/null)\" != \"Stopped\" ]\n}\n\nlog() {\n    local msg=$1\n    logger -t pcmkrestart \"$1\"\n}\n\nHOSTNAME=$(/bin/hostname -s)\nif [ x\"${TRIPLEO_MINOR_UPDATE,,}\" != x\"true\" ]; then\n    if [ x\"${TRIPLEO_HA_WRAPPER_RESOURCE_EXISTS,,}\" = x\"false\" ]; then\n        # Do not restart during initial deployment, as the resource\n        # has just been created.\n        SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n        if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n            log \"Initial deployment, skipping the restart of ${BUNDLE_NAME}\"\n\tfi\n        exit 0\n    else\n        # During a stack update, this script is called in parallel on\n        # every node the resource runs on, after the service's configs\n        # have been updated on all nodes. So we need to run pcs only\n        # once (e.g. on the service's boostrap node).\n        if bundle_can_be_restarted ${BUNDLE_NAME}; then\n            SERVICE_NODEID=$(/bin/hiera -c /etc/puppet/hiera.yaml \"${TRIPLEO_SERVICE}_short_bootstrap_node_name\")\n            if [[ \"${HOSTNAME,,}\" == \"${SERVICE_NODEID,,}\" ]]; then\n                replicas_running=$(crm_resource -Q -r $BUNDLE_NAME --locate 2>&1 | wc -l)\n                if [ \"$replicas_running\" != \"0\" ]; then\n                    log \"Restarting ${BUNDLE_NAME} globally. Stopping:\"\n                    /sbin/pcs resource disable --wait=__PCMKTIMEOUT__ $BUNDLE_NAME\n                    log \"Restarting ${BUNDLE_NAME} globally. Starting:\"\n                    /sbin/pcs resource enable --wait=__PCMKTIMEOUT__ $BUNDLE_NAME\n                else\n                    log \"${BUNDLE_NAME} is not running anywhere,\" \\\n                         \"cleaning up to restart it globally if necessary\"\n                    /sbin/pcs resource cleanup $BUNDLE_NAME\n                fi\n            else\n                log \"Skipping global restart of ${BUNDLE_NAME} on ${HOSTNAME} it will be restarted by node ${SERVICE_NODEID}\"\n            fi\n\n        else\n            log \"No global restart needed for ${BUNDLE_NAME}.\"\n        fi\n    fi\nelse\n    # During a minor update workflow however, a host gets fully\n    # updated before updating the next one. So unlike stack\n    # update, at the time this script is called, the service's\n    # configs aren't updated on all nodes yet. So only restart the\n    # resource locally, where it's guaranteed that the config is\n    # up to date.\n    HOST=$(facter hostname)\n\n    if bundle_can_be_restarted ${BUNDLE_NAME}; then\n\t# if the resource is running locally, restart it\n\tif crm_resource -r $BUNDLE_NAME --locate 2>&1 | grep -w -q \"${HOST}\"; then\n            log \"Restarting ${BUNDLE_NAME} locally on '${HOST}'\"\n            /sbin/pcs resource restart $BUNDLE_NAME \"${HOST}\"\n\n\telse\n\t    # At this point, if no resource is running locally, it's\n\t    # either because a) it has failed previously, or b) because\n\t    # it's an A/P resource running elsewhere.\n\t    # By cleaning up resource, we ensure that a) it will try to\n\t    # restart, or b) it won't do anything if the resource is\n\t    # already running elsewhere.\n            log \"${BUNDLE_NAME} is currently not running on '${HOST}',\" \\\n                 \"cleaning up its state to restart it if necessary\"\n            /sbin/pcs resource cleanup $BUNDLE_NAME node=\"${HOST}\"\n\tfi\n\n\t# Wait until the resource is in the expected target state\n\t$RESTART_SCRIPTS_DIR/pacemaker_wait_bundle.sh \\\n            $RESOURCE_NAME $BUNDLE_NAME \\\n            \"$WAIT_TARGET_LOCAL\" \"$WAIT_TARGET_ANYWHERE\" \\\n\t    \"${HOST}\" __PCMKTIMEOUT__\n    else\n        log \"No restart needed for ${BUNDLE_NAME}.\"\n    fi\nfi\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_wait_bundle.sh": "#!/usr/bin/bash\n\n# ----\n# Wait for an OCF resource or a bundle to be restarted\n# ----\n# e.g.:\n# M/S OCF:      $0 galera galera-bundle Master\n# clone OCF:    $0 rabbitmq rabbitmq-bundle Started\n# A/P M/S OCF:  $0 redis redis-bundle Slave Master\n# A/P bundle:   $0 openstack-cinder-volume openstack-cinder-volume _ Started\n# clone bundle: $0 haproxy-bundle haproxy-bundle Started\n\n# design note 1:\n#  - this script is called during a minor update; it is called\n#    once per node that hosts a service replica.\n#  - the purpose of this script is to ensure that restarting the\n#    service replica locally won't disrupt the service availability\n#    for the end user. To reach that goal, the script waits until the\n#    service is restarted locally or globallu and reaches a given\n#    target state (i.e. Started, Slave or Master).\n# design note 2:\n#   - we don't want to track restart error: our only job is to ensure\n#     service restart synchronization, not service health.\n#   - In particular, we don't want to error out in case the resource\n#     cannot be restarted locally, because that would make the minor\n#     update fail, even if potentially other replicas still provide\n#     the service.\n# design note 3:\n#   - we can bail out early if we determine that the resource can't\n#     be restarted automatically by pacemaker (e.g. its \"blocked\",\n#     unmanaged or disabled).\n\nlog() {\n    local msg=$1\n    echo \"$(date -u): $1\"\n}\n\nusage() {\n    echo 2>&1 \"Usage: $0 NAME BUNDLE_NAME ROLE_LOCAL [ROLE_ANYWHERE] [HOST] [TIMEOUT]\"\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\n#\n# Utility functions to detect stuck resources\n#\n\nbundle_failures_locally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local replica_name\n    for i in $(seq 0 $last); do\n\treplica_name=${BUNDLE_NAME}-${engine}-${i}\n\tcrm_failcount -q -G -r $replica_name -N $HOST\n    done\n}\n\nbundle_failures_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    for i in $(seq 0 $last); do\n\tcrm_failcount -q -G -r ${BUNDLE_NAME}-${engine}-${i}\n    done\n}\n\nbundle_running_globally() {\n    local engine=$BUNDLE_CONTAINER_ENGINE\n    # return the number of running bundles replica, i.e. the number of\n    # docker/podman resource replicas currently running in the cluster\n    crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:heartbeat:${engine}']/node)\" -\n}\n\nocf_failures_globally() {\n    local replicas=$BUNDLE_REPLICAS\n    local last=$(($replicas - 1))\n    local bundle_node\n    for i in $(seq 0 $last); do\n\tbundle_node=${BUNDLE_NAME}-${i}\n\tcrm_failcount -q -G -r $NAME -N $bundle_node\n    done\n}\n\ndid_resource_failed_locally() {\n    local failures\n    local running\n    local remotehost\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# if we're dealing with an ocf resource, it is running on a\n\t# pacemaker_remote rather that on the real host, and the\n\t# failcounts are thus associated to the pcmk remote. Replace\n\t# the host's name with the pcmk remote's name.\n        remotehost=$(crm_mon --as-xml | xmllint --xpath \"string(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource/node[@name='${HOST}']/../../resource[@resource_agent='${OCF}:pacemaker:remote']/@id)\" -)\n\tif [ -n \"${remotehost}\" ]; then\n\t    crm_failcount -q -G -r $NAME -N $remotehost | grep -q -w INFINITY\n\t    return $?\n\tfi\n\t# If no pcmk remote is currently running, the failcount from\n\t# the ocf resource is useless, compute the failcount from the\n\t# bundle case instead (computed below).\n    fi\n\n    # for bundles, pacemaker can run any bundle replica locally\n    # (e.g. galera-bundle-docker-{0,1,2}), and a failure happens when\n    # there are no more replica to try.\n    # That is, when _at least_ one replica failed locally, and all the\n    # others either failed or are currently running elsewhere.\n    failures=$(bundle_failures_locally $HOST | grep -c -w INFINITY)\n    running=$(bundle_running_globally)\n    test $failures -gt 0 && \\\n    test $(( $failures + $running )) -ge $BUNDLE_REPLICAS\n}\n\ndid_resource_failed_globally() {\n    local remotecount\n    local failures\n    if [ \"${NAME}\" != \"${BUNDLE_NAME}\" ]; then\n\t# we check the state of an ocf resource only if the\n\t# pcmkremotes are started\n        remotecount=$(crm_mon --as-xml | xmllint --xpath \"count(//resources/bundle[@id='${BUNDLE_NAME}']/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node)\" -)\n\tif [ \"${remotecount}\" = \"0\" ]; then\n\t    # no pcmkremote is running, so check the bundle state\n\t    # instead of checking the ocf resource\n\t    # bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\t    failures=$(bundle_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\telse\n\t    # ocf resource failed if it failed to start on\n\t    # all $BUNDLE_REPLICAS bundle nodes\n\t    failures=$(ocf_failures_globally | grep -c -w INFINITY)\n\t    test $failures -eq $BUNDLE_REPLICAS\n\tfi\n    else\n\t# bundle failed if all ${BUNDLE_REPLICAS} replicas failed\n\tfailures=$(bundle_failures_globally | grep -c -w INFINITY)\n\ttest $failures -eq $BUNDLE_REPLICAS\n    fi\n}\n\n\n# Input validation\n#\n\nNAME=$1\nif [ -z \"${NAME}\" ]; then\n    echo 2>&1 \"Error: argument NAME must not be empty\"\n    exit 1\nfi\n\nBUNDLE_NAME=$2\nif [ -z \"${BUNDLE_NAME}\" ]; then\n    echo 2>&1 \"Error: argument BUNDLE_NAME must not be empty\"\n    exit 1\nfi\n\nROLE_LOCAL=$3\nif [ \"${ROLE_LOCAL}\" = \"_\" ]; then\n    ROLE_LOCAL=\"\"\nfi\n\nROLE_ANYWHERE=$4\nif [ \"${ROLE_ANYWHERE}\" = \"_\" ]; then\n    ROLE_ANYWHERE=\"\"\nfi\n\nif [ -z \"${ROLE_LOCAL}\" ]; then\n    if [ -z \"${ROLE_ANYWHERE}\" ]; then\n        echo 2>&1 \"Error: either ROLE_LOCAL or ROLE_ANYWHERE must be non empty\"\n        exit 1\n    fi\nelse\n    if !(echo \"${ROLE_LOCAL}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n        echo 2>&1 \"Error: argument ROLE_LOCAL must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n        exit 1\n    fi\nfi\n\nif [ -n \"${ROLE_ANYWHERE}\" ] && !(echo \"${ROLE_ANYWHERE}\" | grep -q -x -E \"(Started|Slave|Master|Unpromoted|Promoted)\"); then\n    echo 2>&1 \"Error: argument ROLE_ANYWHERE must be either 'Started' 'Slave' 'Master' 'Unpromoted' or 'Promoted'\"\n    exit 1\nfi\n\n# Ensure compatibility with pacemaker 2.1\nif pacemaker_supports_promoted; then\n    ROLE_LOCAL=$(echo \"$ROLE_LOCAL\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    ROLE_ANYWHERE=$(echo \"$ROLE_ANYWHERE\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    OCF=\"ocf\"\nelse\n    OCF=\"ocf:\"\nfi\n\nHOST=${5:-$(facter hostname)}\nTIMEOUT=${6:-__PCMKTIMEOUT__}\n\n\n# Configure the search\n# ----\n# Note: we can't use crm_resource in all searches because we can't\n# easily extract the host the OCF resources run on (crm_resource\n# returns the pcmk-remote nodes rather than the hosts)\n# So instead, we implement various searches with XPath directly.\n\nif [ \"${BUNDLE_NAME}\" != \"${NAME}\" ]; then\n# ocf resource\nlocal_resource_xpath=\"//bundle/replica/resource[@resource_agent='${OCF}:pacemaker:remote']/node[@name='${HOST}']/../../resource[@id='${NAME}']\"\nany_resource_xpath=\"//bundle//resource[@id='${NAME}']\"\nreplicas_xpath=\"//bundle/primitive[@id='${BUNDLE_NAME}']/../*[boolean(@image) and boolean(@replicas)]\"\nelse\n# bundle resource\nlocal_resource_xpath=\"//bundle[@id='${NAME}']/replica/resource/node[@name='${HOST}']/../../resource\"\nany_resource_xpath=\"//bundle[@id='${NAME}']//resource\"\nreplicas_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nfi\n\nbundle_def_xpath=\"//bundle[@id='${BUNDLE_NAME}']/*[boolean(@image) and boolean(@replicas)]\"\nBUNDLE_CONTAINER_ENGINE=$(cibadmin -Q | xmllint --xpath \"name(${bundle_def_xpath})\" -)\nBUNDLE_REPLICAS=$(cibadmin -Q | xmllint --xpath \"string(${bundle_def_xpath}/@replicas)\" -)\n\n\n# The wait algorithm follows a two-stage approach\n#  1. Depending on how the script is called, we first check whether\n#     the resource is restarted locally. An A/P resource may be\n#     restarted elsewhere in the cluster.\n#  2. If needed, check whether the A/P resource has restarted\n#     elsewhere. For A/P M/S resources, in case the resource is\n#     restarted as Slave locally, ensure a Master is available.\n\nsuccess=1\nbailout=1\ntimeout=$TIMEOUT\nrole=\"\"\n\n# Stage 1: local check\nif [ -n \"$ROLE_LOCAL\" ]; then\n    log \"Waiting until ${NAME} has restarted on ${HOST} and is in state ${ROLE_LOCAL}\"\n    log \"Will probe resource state with the following XPath pattern: ${local_resource_xpath}\"\n\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resource=$(crm_mon -r --as-xml | xmllint --xpath \"${local_resource_xpath}\" - 2>/dev/null)\n        role=$(echo \"${resource}\" | sed -ne 's/.*\\Wrole=\"\\([^\"]*\\)\".*/\\1/p')\n\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resource}\" | grep -q -w \"\\Wblocked=\\\"true\\\"\"; then\n            log \"${NAME} is blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_locally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif [ \"$role\" = \"$ROLE_LOCAL\" ]; then\n            success=0\n            continue\n        elif [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" = \"$ROLE_ANYWHERE\" ]; then\n            # A/P: we are restarted in the expected state\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_LOCAL} on ${HOST}\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\n# Stage 2: global check\nif [ $timeout -gt 0 ] && [ -n \"$ROLE_ANYWHERE\" ] && [ \"$role\" != \"$ROLE_ANYWHERE\" ]; then\n    log \"Wait until ${NAME} is restarted anywhere in the cluster in state ${ROLE_ANYWHERE}\"\n    log \"Will probe resource state with the following XPath pattern: ${any_resource_xpath}\"\n\n    success=1\n    bailout=1\n    while [ $timeout -gt 0 ] && [ $bailout -ne 0 ] && [ $success -ne 0 ]; do\n        resources=$(crm_mon -r --as-xml | xmllint --xpath \"${any_resource_xpath}\" - 2>/dev/null)\n\tif [ \"$(crm_resource --meta -r ${NAME} -g is-managed 2>/dev/null)\" = \"false\" ]; then\n            log \"${NAME} is unmanaged, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif [ \"$(crm_resource --meta -r ${NAME} -g target-role 2>/dev/null)\" = \"Stopped\" ]; then\n            log \"${NAME} is disabled, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif ! (echo \"${resources}\" | grep -q -w \"\\Wblocked=\\\"false\\\"\"); then\n            log \"${NAME} blocked, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n\telif did_resource_failed_globally; then\n            log \"${NAME} is in failed state, will never reach target role. Bailing out\"\n            bailout=0\n            continue\n        elif echo \"${resources}\" | grep -q -w \"\\Wrole=\\\"${ROLE_ANYWHERE}\\\"\"; then\n            success=0\n            continue\n        else\n            log \"Waiting for ${NAME} to transition to role ${ROLE_ANYWHERE} anywhere in the cluster\"\n        fi\n\n        if [ $bailout -ne 0 ] && [ $success -ne 0 ]; then\n            sleep 4\n            timeout=$((timeout-4))\n        fi\n    done\nfi\n\nif [ $timeout -le 0 ]; then\n    log \"Timeout reached after ${TIMEOUT}s while waiting for ${NAME} to be restarted\"\nelif [ $bailout -le 0 ]; then\n    log \"Restart monitoring for ${NAME} cancelled\"\nfi\n\nif [ $success -eq 0 ]; then\n    log \"${NAME} successfully restarted\"\nelse\n    log \"${NAME} was not restarted properly\"\nfi\n\n# Don't block minor update or stack update if the wait was unsuccessful\nexit 0\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/wait-port-and-run.sh": "#!/usr/bin/bash\nset -eu\n\nHOST=$1\nPORT=$2\n\necho \"$(date -u): Checking whether we can bind to ${HOST}:${PORT}\"\nwhile (ss -Htnl src \"${HOST}\" \"sport = :${PORT}\" | grep -wq \"${PORT}\"); do\n    echo \"$(date -u): ${HOST}:${PORT} still in use, waiting...\";\n    sleep 10;\ndone\n\nshift 2\nCOMMAND=\"$*\"\nif [ -z \"${COMMAND}\" ]; then\n    COMMAND=\"true\"\nfi\nexec $COMMAND\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_resource_lock.sh": "#!/usr/bin/bash\n\nMAX_RETRIES=10\nCIB_ENOTFOUND=105\n\nusage() {\n   echo \"Set a global property in the cluster with a validity timestamp.\"\n   echo \"Usage:\"\n   echo \"   $0 --acquire <lock_name> <lock_owner> <lock_ttl_in_seconds>\"\n   echo \"   $0 --release <lock_name> <lock_owner>\"\n   echo\n}\n\nlog() {\n    echo \"$(date -u): $1\" 1>&2\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\nlock_create() {\n    local name=$1\n    local data=$2\n    # cibadmin won't overwrite a key if someone else succeeded to create it concurrently\n    cibadmin --sync-call --scope crm_config --create --xml-text \"<cluster_property_set id='${name}'><nvpair id='${name}-pair' name='${name}' value='${data}'/></cluster_property_set>\" &>/dev/null\n    return $?\n}\n\nlock_update() {\n    local name=$1\n    local expected_data=$2\n    local new_data=$3\n    # we only update the lock we expect to see, so we can't update someone else's lock\n    cibadmin --sync-call --scope crm_config --modify --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" --xml-text \"<nvpair id='${name}-pair' name='${name}' value='${new_data}'/>\" &>/dev/null\n    return $?\n}\n\nlock_delete() {\n    local name=$1\n    local expected_data=$2\n    # we only delete the lock we expect to see, so we can't delete someone else's lock\n    cibadmin --sync-call --scope crm_config --delete --xpath \"//cluster_property_set/nvpair[@name='${name}' and @value='${expected_data}']/..\" &>/dev/null\n    return $?\n}\n\nlock_get() {\n    local lockname=$1\n    local res\n    local rc\n    res=$(cibadmin --query --scope crm_config --xpath \"//cluster_property_set/nvpair[@name='$lockname']\" 2>/dev/null)\n    rc=$?\n    if [ $rc -eq 0 ]; then\n        echo \"$res\" | sed -n 's/.*value=\"\\([^\"]*\\)\".*/\\1/p'\n    fi\n    return $rc\n}\n\nlock_owner() {\n    local lock=$1\n    echo \"$lock\" | cut -d':' -f1\n}\n\nlock_has_expired() {\n    local lock=$1\n    local expiry=$(echo \"$lock\" | cut -d':' -f2)\n    local now=$(date +%s)\n    test $now -ge $expiry\n}\n\n\n# Perform a lock action and restart if the CIB has been modified before\n# committing the lock action\ntry_action() {\n    local fun=$1\n    local lock=$2\n    local requester=$3\n    local args=${4:-}\n    local tries=$MAX_RETRIES\n    local rc=1\n    if [ \"$fun\" = \"lock_acquire\" ] || [ \"$fun\" = \"lock_release\" ]; then\n        log \"Try running $fun\"\n    else\n        return 2\n    fi\n    while [ $rc -ne 0 ]; do\n        $fun $lock $requester $args\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Operation $1 succeeded\"\n            return 0\n        elif [ $rc -eq 3 ]; then\n            # rc == 3 -> CIB changed before push\n            if [ $tries -eq 0 ]; then\n                log \"Failed to commit after $MAX_RETRIES retries. Bailing out.\"\n                return 2\n            else\n                log \"Failed to commit. Retrying operation.\"\n                tries=$(($tries - 1))\n            fi\n        elif [ $rc -eq 2 ]; then\n            # rc == 2 -> unrecoverable cib error (e.g. pacemaker down)\n            log \"Unexpected failure. Bailing out\"\n            return $rc\n        else\n            # rc == 1 -> lock error (not owner, lock doesn't exists)\n            return $rc\n        fi\n    done\n}\n\n# The lock mechanism uses cibadmin's atomic creation so cluster-wide\n# state coherency is guaranteed by pacemaker\nlock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc\n    local lock\n    local expiry\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -n \"$lock\" ]; then\n        lock_has_expired $lock\n        rc=$?\n        if [ $rc -eq 0 ]; then\n            log \"Lock has expired, now available for being held\"\n        else\n            # lock is still held. check whether we're the owner\n            owner=$(lock_owner $lock)\n            if [ \"$owner\" = \"$requester\" ];then\n                log \"Requester already owns the lock, acquiring attempt will just reconfigure the TTL\"\n            else\n                log \"Lock is held by someone else ($owner)\"\n                return 1\n            fi\n        fi\n    else\n        log \"Lock is not held yet\"\n    fi\n\n    # prepare the lock info\n    expiry=$(($(date +%s) + $ttl))\n\n    if [ -n \"$lock\" ]; then\n        log \"Attempting to update the lock\"\n        lock_update $lockname \"$lock\" \"$requester:$expiry\"\n        rc=$?\n    else\n        log \"Attempting to acquire the lock\"\n        lock_create $lockname \"$requester:$expiry\"\n        rc=$?\n    fi\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' acquired by '$requester', valid until $(date -d @$expiry)\"\n        return 0\n    else\n        log \"CIB changed, lock cannot be acquired\"\n        return 3\n    fi\n}\n\n\n# The lock mechanism uses the CIB's num_updates tag to implement\n# a conditional store. Cluster-wide locking is guaranteed by pacemaker\nlock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n    local lock\n    local owner\n\n    log \"Check whether the lock is already held in the CIB\"\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        log \"Could not retrieve info from the CIB\"\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        log \"Lock doesn't exist. Nothing to release\"\n        return 0\n    else\n        log \"Lock exists, check whether we're the owner\"\n        owner=$(lock_owner $lock)\n        if [ \"$owner\" != \"$requester\" ];then\n            log \"Lock is held by someone else ($owner), will not unlock\"\n            return 1\n        fi\n    fi\n\n    lock_delete $lockname \"$lock\"\n    rc=$?\n\n    if [ $rc -eq 0 ]; then\n        log \"Lock '$lockname' released by '$requester'\"\n        return 0\n    else\n        log \"CIB deletion error, lock cannot be released\"\n        return 3\n    fi\n}\n\n\n# Retrieve the owner of a lock from the CIB\n# this is a read-only operation, so no need to log debug info\nlock_get_owner() {\n    local lockname=$1\n    local rc\n    local lock\n    local owner\n\n    lock=$(lock_get $lockname)\n    rc=$?\n    if [ $rc -ne 0 ] && [ $rc -ne $CIB_ENOTFOUND ]; then\n        return 2\n    fi\n\n    if [ -z \"$lock\" ]; then\n        return 1\n    else\n        lock_owner $lock\n        return 0\n    fi\n}\n\n\nACTION=$1\nLOCKNAME=$2\nREQUESTER=$3\nTTL=${4:-60}\n\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nif [ $ACTION != \"--help\" ]; then\n    if [ -z \"$LOCKNAME\" ]; then\n        error \"You must specific a lock name\"\n    fi\n    if [ $ACTION != \"--owner\" ] && [ $ACTION != \"-o\" ]; then\n        if [ -z \"$REQUESTER\" ]; then\n            error \"You must specific a lock requester\"\n        fi\n    fi\nfi\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) try_action lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --release|-r) try_action lock_release $LOCKNAME $REQUESTER;;\n    --acquire-once|-A) lock_acquire $LOCKNAME $REQUESTER $TTL;;\n    --owner|-o) lock_get_owner $LOCKNAME;;\n    *) error \"Invalid action\";;\nesac\nexit $?\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_mutex_restart_bundle.sh": "#!/usr/bin/bash\n\n# pacemaker_mutex_restart_bundle.sh --lock mysql galera galera-bundle Master _\n# pacemaker_mutex_restart_bundle.sh --lock ovn_dbs ovndb_servers ovn-dbs-bundle Slave Master\n\nset -u\n\nusage() {\n    echo \"Restart a clustered resource in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --lock <tripleo-service> <pcmk-resource> <pcmk-bundle> <target-state-local> <target-state-cluster>\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\npacemaker_supports_promoted() {\n    # The Promoted token is only matched in recent pacemaker versions\n    grep -wq \"<value>Promoted</value>\" /usr/share/pacemaker/resources-*.rng\n}\n\nACTION=$1\ncase $ACTION in\n    --help) usage; exit 0;;\n    --lock) ;;\n    *) error \"Unknown action '$ACTION'\";;\nesac\n\nTRIPLEO_SERVICE=$2\nLOCK_NAME=${TRIPLEO_SERVICE}-restart-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to restart resource $TRIPLEO_SERVICE\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\nRESOURCE_NAME=$3\nBUNDLE_NAME=$4\nWAIT_TARGET_LOCAL=$5\nWAIT_TARGET_ANYWHERE=${6:-_}\n\nif pacemaker_supports_promoted; then\n    WAIT_TARGET_LOCAL=$(echo \"$5\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    WAIT_TARGET_ANYWHERE=$(echo \"${6:-_}\" | sed -e 's/Master/Promoted/' -e 's/Slave/Unpromoted/')\n    promoted_role=\"Promoted\"\nelse\n    promoted_role=\"Master\"\nfi\n\n# The lock TTL should accomodate for the resource start/promote timeout\nif [ \"$RESOURCE_NAME\" != \"$BUNDLE_NAME\" ]; then\n    if [ \"$WAIT_TARGET_LOCAL\" = \"$promoted_role\" ] || [ \"$WAIT_TARGET_ANYWHERE\" = \"$promoted_role\" ]; then\n        rsc_op=\"promote\"\n    else\n        rsc_op=\"start\"\n    fi\n    # <op id=\"galera-promote-interval-0s\" interval=\"0s\" name=\"promote\" on-fail=\"block\" timeout=\"300s\"/>\n    PCMK_TTL=$(cibadmin -Q | xmllint -xpath \"string(//primitive[@id='${RESOURCE_NAME}']/operations/op[@name='${rsc_op}']/@timeout)\" - | sed 's/s$//')\n    LOCK_TTL=$((PCMK_TTL + 30))\nelse\n    # The podman RA's default start timeout\n    LOCK_TTL=90\nfi\n\nlog \"Acquire a ${LOCK_TTL}s restart lock for service $TRIPLEO_SERVICE before restarting it\"\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nrc=1\nwhile [ $rc -ne 0 ]; do\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire $LOCK_NAME $LOCK_OWNER $LOCK_TTL\n    rc=$?\n    if [ $rc != 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not acquire lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Could not acquire lock, retrying\"\n            sleep 10\n        fi\n    fi\ndone\n\nlog \"Restart the service $TRIPLEO_SERVICE locally\"\n# Reuse the local restart script in t-h-t (driven by env var TRIPLEO_MINOR_UPDATE)\nTRIPLEO_MINOR_UPDATE=true /var/lib/container-config-scripts/pacemaker_restart_bundle.sh $TRIPLEO_SERVICE $RESOURCE_NAME $BUNDLE_NAME $WAIT_TARGET_LOCAL $WAIT_TARGET_ANYWHERE\n\n# If we reached this point, always try to release the lock\nlog \"Release the restart lock for service $TRIPLEO_SERVICE\"\n/var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $LOCK_NAME $LOCK_OWNER\nrc=$?\nif [ $rc -ne 0 ] && [ $rc -ne 1 ]; then\n    error \"Could not release held lock (rc: $rc)\"\nfi\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_mutex_shutdown.sh": "#!/usr/bin/bash\n\n# pacemaker_mutex_shutdown.sh --acquire\n# pacemaker_mutex_shutdown.sh --release\n\nset -u\n\nusage() {\n    echo \"Shutdown a cluster node in a coordinated way across the cluster\"\n    echo \"Usage:\"\n    echo \"   $0 --acquire # prevent other node from shutting down until we hold the lock\"\n    echo \"   $0 --release # release the lock, other node can compete for the shutdown lock\"\n    echo\n}\n\nlog() {\n    echo \"$(date -u): $1\"\n}\n\nerror() {\n    echo \"$(date -u): $1\" 1>&2\n    exit 1\n}\n\n# Loop until we hold the lock. The lock has a TTL, so we're guaranteed to get it eventually\nshutdown_lock_acquire() {\n    local lockname=$1\n    local requester=$2\n    local ttl=$3\n    local rc=1\n    local current_owner\n    local owner_stopped\n    local owner_rc\n\n    log \"Acquiring the shutdown lock\"\n    while [ $rc -ne 0 ]; do\n        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --acquire-once $lockname $requester $ttl\n        rc=$?\n        if [ $rc -ne 0 ]; then\n            if [ $rc -eq 2 ]; then\n                error \"Could not acquire the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n            else\n                # The lock is held by another node.\n                current_owner=$(/var/lib/container-config-scripts/pacemaker_resource_lock.sh --owner $lockname)\n                owner_rc=$?\n                if [ $owner_rc -eq 2 ]; then\n                    error \"Could not get the shutdown lock owner due to unrecoverable error (rc: $owner_rc), bailing out\"\n                fi\n                if [ $owner_rc -eq 0 ]; then\n                    # If the owner is marked as offline, that means it has shutdown and\n                    # we can clean the lock preemptively and try to acquire it.\n                    owner_stopped=$(crm_mon -1X | xmllint --xpath 'count(//nodes/node[@name=\"'${current_owner}'\" and @online=\"false\" and @unclean=\"false\"])' -)\n                    if [ \"${owner_stopped}\" = \"1\" ]; then\n                        log \"Shutdown lock held by stopped node '${current_owner}', lock can be released\"\n                        /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $current_owner\n                        continue\n                    fi\n                fi\n                log \"Shutdown lock held by another node (rc: $rc), retrying\"\n                sleep 10\n            fi\n        fi\n    done\n    log \"Shutdown lock acquired\"\n    return 0\n}\n\n\n# Release the lock if we still own it. Not owning it anymore is not fatal\nshutdown_lock_release() {\n    local lockname=$1\n    local requester=$2\n    local rc\n\n    log \"Releasing the shutdown lock\"\n    /var/lib/container-config-scripts/pacemaker_resource_lock.sh --release $lockname $requester\n    rc=$?\n    if [ $rc -ne 0 ]; then\n        if [ $rc -gt 1 ]; then\n            error \"Could not release the shutdown lock due to unrecoverable error (rc: $rc), bailing out\"\n        else\n            log \"Shutdown lock no longer held, nothing to do\"\n        fi\n    else\n        log \"Shutdown lock released\"\n    fi\n    return 0\n}\n\n\nACTION=$1\nif [ -z \"$ACTION\" ]; then\n    error \"Action must be specified\"\nfi\n\nLOCK_NAME=tripleo-shutdown-lock\nLOCK_OWNER=$(crm_node -n 2>/dev/null)\nrc=$?\nif [ $rc -ne 0 ]; then\n    if [ $rc -eq 102 ]; then\n        log \"Cluster is not running locally, no need to aquire the shutdown lock\"\n        exit 0\n    else\n        error \"Unexpected error while connecting to the cluster (rc: $rc), bailing out\"\n    fi\nfi\n\n# We start with a very high TTL, that long enough to accomodate a cluster stop.\n# As soon as the node will get offline, the other competing node will be entitled\n# to steal the lock, so they should never wait that long in practice.\nLOCK_TTL=600\n\n\ncase $ACTION in\n    --help) usage; exit 0;;\n    --acquire|-a) shutdown_lock_acquire ${LOCK_NAME} ${LOCK_OWNER} ${LOCK_TTL};;\n    --release|-r) shutdown_lock_release ${LOCK_NAME} ${LOCK_OWNER};;\n    *) error \"Invalid action\";;\nesac\nexit $?\n", "file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Contains a static list of common things necessary for containers\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"RpcPort\": {\"default\": 5672, \"description\": \"The network port for messaging backend\", \"type\": \"number\"}, \"PcmkConfigRestartTimeout\": {\"default\": 600, \"description\": \"Time in seconds to wait for a pacemaker resource to restart when a config change is detected and the resource is being restarted\", \"type\": \"number\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}}, \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"docker_enabled\": {\"equals\": [{\"get_param\": \"ContainerCli\"}, \"docker\"]}}, \"outputs\": {\"container_config_scripts\": {\"description\": \"Shared container config scripts\", \"value\": {\"container_puppet_apply.sh\": {\"mode\": \"0700\", \"content\": \"#!/bin/bash\\nset -eux\\nSTEP=$1\\nTAGS=$2\\nCONFIG=$3\\nEXTRA_ARGS=${4:-''}\\nif [ -d /tmp/puppet-etc ]; then\\n  # ignore copy failures as these may be the same file depending on docker mounts\\n  cp -a /tmp/puppet-etc/* /etc/puppet || true\\nfi\\necho \\\"{\\\\\\\"step\\\\\\\": ${STEP}}\\\" > /etc/puppet/hieradata/docker_puppet.json\\n# $::deployment_type in puppet-tripleo\\nexport FACTER_deployment_type=containers\\nset +e\\npuppet apply $EXTRA_ARGS \\\\\\n    --verbose \\\\\\n    --detailed-exitcodes \\\\\\n    --summarize \\\\\\n    --color=false \\\\\\n    --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \\\\\\n    --tags $TAGS \\\\\\n    -e \\\"noop_resource('package'); ${CONFIG}\\\"\\nrc=$?\\nset -e\\nset +ux\\nif [ $rc -eq 2 -o $rc -eq 0 ]; then\\n    exit 0\\nfi\\nexit $rc\\n\"}, \"pyshim.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/pyshim.sh\"}}, \"pacemaker_restart_bundle.sh\": {\"mode\": \"0755\", \"content\": {\"str_replace\": {\"template\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_restart_bundle.sh\"}, \"params\": {\"__PCMKTIMEOUT__\": {\"get_param\": \"PcmkConfigRestartTimeout\"}}}}}, \"pacemaker_wait_bundle.sh\": {\"mode\": \"0755\", \"content\": {\"str_replace\": {\"template\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_wait_bundle.sh\"}, \"params\": {\"__PCMKTIMEOUT__\": {\"get_param\": \"PcmkConfigRestartTimeout\"}}}}}, \"wait-port-and-run.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/wait-port-and-run.sh\"}}, \"pacemaker_resource_lock.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_resource_lock.sh\"}}, \"pacemaker_mutex_restart_bundle.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_mutex_restart_bundle.sh\"}}, \"pacemaker_mutex_shutdown.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/pacemaker_mutex_shutdown.sh\"}}}}, \"volumes_base\": {\"description\": \"Base volume list\", \"value\": {\"list_concat\": [[\"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro\", \"/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro\", \"/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro\", \"/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro\", \"/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro\", \"/dev/log:/dev/log\"], {\"if\": [\"internal_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"InternalTLSCAFile\"}, \"ro\"]]}], null]}]}}, \"volumes\": {\"description\": \"Common volumes for the containers.\", \"value\": {\"list_concat\": [{\"list_concat\": [[\"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro\", \"/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro\", \"/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro\", \"/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro\", \"/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro\", \"/dev/log:/dev/log\"], {\"if\": [\"internal_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"InternalTLSCAFile\"}, \"ro\"]]}], null]}]}, [\"/etc/puppet:/etc/puppet:ro\"]]}}, \"pacemaker_restart_volumes\": {\"description\": \"Common volumes for the pacemaker restart containers.\", \"value\": {\"list_concat\": [{\"list_concat\": [[\"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro\", \"/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro\", \"/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro\", \"/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro\", \"/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro\", \"/dev/log:/dev/log\"], {\"if\": [\"internal_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"InternalTLSCAFile\"}, \"ro\"]]}], null]}]}, [\"/var/lib/container-config-scripts:/var/lib/container-config-scripts:ro\", \"/dev/shm:/dev/shm:rw\", \"/etc/puppet:/etc/puppet:ro\"], {\"if\": [\"docker_enabled\", [\"/etc/corosync/corosync.conf:/etc/corosync/corosync.conf:ro\"], null]}]}}, \"container_puppet_apply_volumes\": {\"description\": \"Common volumes needed to run the container_puppet_apply.sh from container_config_scripts\", \"value\": {\"list_concat\": [{\"list_concat\": [[\"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro\", \"/etc/pki/ca-trust/source/anchors:/etc/pki/ca-trust/source/anchors:ro\", \"/etc/pki/tls/certs/ca-bundle.crt:/etc/pki/tls/certs/ca-bundle.crt:ro\", \"/etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/certs/ca-bundle.trust.crt:ro\", \"/etc/pki/tls/cert.pem:/etc/pki/tls/cert.pem:ro\", \"/dev/log:/dev/log\"], {\"if\": [\"internal_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"InternalTLSCAFile\"}, \"ro\"]]}], null]}]}, [\"/var/lib/container-config-scripts/container_puppet_apply.sh:/container_puppet_apply.sh:ro\", \"/etc/puppet:/tmp/puppet-etc:ro\", \"/usr/share/openstack-puppet/modules:/usr/share/openstack-puppet/modules:ro\"]]}}, \"healthcheck_rpc_port\": {\"description\": \"healthcheck command that probes the RpcPort\", \"value\": {\"test\": {\"str_replace\": {\"template\": \"/openstack/healthcheck RPCPORT\", \"params\": {\"RPCPORT\": {\"get_param\": \"RpcPort\"}}}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Mysql client settings\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role for setting mysql client parameters\", \"value\": {\"service_name\": \"mysql_client\", \"config_settings\": {\"tripleo::profile::base::database::mysql::client::mysql_client_bind_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::base::database::mysql::client::enable_ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"tripleo::profile::base::database::mysql::client::ssl_ca\": {\"get_param\": \"InternalTLSCAFile\"}}, \"step_config\": \"include tripleo::profile::base::database::mysql::client\"}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Cinder base service. Shared by all Cinder services.\\n\", \"parameters\": {\"CinderStorageAvailabilityZone\": {\"default\": \"nova\", \"description\": \"The Cinder service's storage availability zone.\", \"type\": \"string\"}, \"CinderPassword\": {\"description\": \"The password for the cinder service and db account.\", \"type\": \"string\", \"hidden\": true}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"CinderDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging on Cinder services.\", \"type\": \"boolean\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"CinderCronDbPurgeMinute\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Minute\\n\", \"default\": \"1\"}, \"CinderCronDbPurgeHour\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Hour\\n\", \"default\": \"0\"}, \"CinderCronDbPurgeMonthday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month Day\\n\", \"default\": \"*\"}, \"CinderCronDbPurgeMonth\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month\\n\", \"default\": \"*\"}, \"CinderCronDbPurgeWeekday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Week Day\\n\", \"default\": \"*\"}, \"CinderCronDbPurgeUser\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - User\\n\", \"default\": \"cinder\"}, \"CinderCronDbPurgeAge\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Age\\n\", \"default\": \"30\"}, \"CinderCronDbPurgeDestination\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Log destination\\n\", \"default\": \"/var/log/cinder/cinder-rowsflush.log\"}, \"CinderCronDbPurgeMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Max Delay\\n\", \"default\": \"3600\"}, \"CinderRpcResponseTimeout\": {\"default\": 60, \"description\": \"Cinder's RPC response timeout, in seconds.\", \"type\": \"number\"}, \"NovaPassword\": {\"type\": \"string\", \"description\": \"The password for the nova service and db account\", \"hidden\": true}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder base service.\", \"value\": {\"service_name\": \"cinder_base\", \"config_settings\": {\"cinder::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"cinder\", \"password\": {\"get_param\": \"CinderPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/cinder\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"cinder\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"cinder::logging::debug\": {\"if\": [{\"get_param\": \"CinderDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"cinder::storage_availability_zone\": {\"get_param\": \"CinderStorageAvailabilityZone\"}, \"cinder::rabbit_heartbeat_timeout_threshold\": 60, \"cinder::rpc_response_timeout\": {\"get_param\": \"CinderRpcResponseTimeout\"}, \"cinder::rabbit_heartbeat_in_pthread\": false, \"cinder::db::database_db_max_retries\": -1, \"cinder::db::database_max_retries\": -1, \"cinder::cron::db_purge::minute\": {\"get_param\": \"CinderCronDbPurgeMinute\"}, \"cinder::cron::db_purge::hour\": {\"get_param\": \"CinderCronDbPurgeHour\"}, \"cinder::cron::db_purge::monthday\": {\"get_param\": \"CinderCronDbPurgeMonthday\"}, \"cinder::cron::db_purge::month\": {\"get_param\": \"CinderCronDbPurgeMonth\"}, \"cinder::cron::db_purge::weekday\": {\"get_param\": \"CinderCronDbPurgeWeekday\"}, \"cinder::cron::db_purge::user\": {\"get_param\": \"CinderCronDbPurgeUser\"}, \"cinder::cron::db_purge::age\": {\"get_param\": \"CinderCronDbPurgeAge\"}, \"cinder::cron::db_purge::destination\": {\"get_param\": \"CinderCronDbPurgeDestination\"}, \"cinder::cron::db_purge::maxdelay\": {\"get_param\": \"CinderCronDbPurgeMaxDelay\"}, \"cinder::glance::glance_api_servers\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"uri\"]}, \"cinder::keystone::service_user::send_service_user_token\": true, \"cinder::keystone::service_user::project_name\": \"service\", \"cinder::keystone::service_user::auth_type\": \"password\", \"cinder::keystone::service_user::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri\"]}, \"cinder::keystone::service_user::password\": {\"get_param\": \"CinderPassword\"}, \"cinder::keystone::service_user::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"cinder::nova::interface\": \"admin\", \"cinder::nova::project_name\": \"service\", \"cinder::nova::auth_type\": \"password\", \"cinder::nova::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri\"]}, \"cinder::nova::password\": {\"get_param\": \"NovaPassword\"}, \"cinder::nova::region_name\": {\"get_param\": \"KeystoneRegion\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backend-nvmeof-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Openstack Cinder NVMeOF backend\\n\", \"parameters\": {\"CinderEnableNVMeOFBackend\": {\"default\": false, \"description\": \"Whether to enable or not the NVMeOF backend for Cinder\", \"type\": \"boolean\"}, \"CinderNVMeOFBackendName\": {\"type\": \"string\", \"default\": \"tripleo_nvmeof\"}, \"CinderNVMeOFAvailabilityZone\": {\"default\": \"\", \"description\": \"The availability zone of the NVMeOF Cinder backend. When set, it overrides the default CinderStorageAvailabilityZone.\\n\", \"type\": \"string\"}, \"CinderNVMeOFTargetPort\": {\"type\": \"number\", \"default\": 4420}, \"CinderNVMeOFTargetHelper\": {\"type\": \"string\", \"default\": \"nvmet\"}, \"CinderNVMeOFTargetProtocol\": {\"type\": \"string\", \"default\": \"nvmet_rdma\", \"description\": \"The target protocol, supported values are nvmet_rdma and nvmet_tcp.\\n\", \"constraints\": [{\"allowed_values\": [\"nvmet_rdma\", \"nvmet_tcp\"]}]}, \"CinderNVMeOFTargetPrefix\": {\"type\": \"string\", \"default\": \"nvme-subsystem\"}, \"CinderNVMeOFTargetPortId\": {\"type\": \"number\", \"default\": 1}, \"CinderNVMeOFTargetNameSpaceId\": {\"type\": \"number\", \"default\": 10}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"type\": \"json\", \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\"}}, \"outputs\": {\"cinder_nvmeof_host_prep_tasks\": {\"description\": \"Host prep tasks related to cinder's NVMeOF backend\", \"value\": {\"if\": [{\"get_param\": \"CinderEnableNVMeOFBackend\"}, [{\"name\": \"ensure /etc/nvme exists\", \"file\": {\"path\": \"/etc/nvme\", \"state\": \"directory\", \"setype\": \"container_file_t\"}}]]}}, \"cinder_nvmeof_volumes\": {\"description\": \"Volumes related to cinder's NVMeOF backend\", \"value\": {\"if\": [{\"get_param\": \"CinderEnableNVMeOFBackend\"}, [\"/etc/nvme:/etc/nvme:z\"]]}}, \"role_data\": {\"description\": \"Role data for the Cinder NVMeOF backend.\", \"value\": {\"service_name\": \"cinder_backend_nvmeof\", \"firewall_rules\": {\"120 LVM nvmet target\": {\"dport\": {\"get_param\": \"CinderNVMeOFTargetPort\"}}}, \"config_settings\": {\"map_merge\": [{\"tripleo::profile::base::cinder::volume::cinder_enable_nvmeof_backend\": {\"get_param\": \"CinderEnableNVMeOFBackend\"}, \"tripleo::profile::base::cinder::volume::nvmeof::volume_backend_name\": {\"get_param\": \"CinderNVMeOFBackendName\"}, \"tripleo::profile::base::cinder::volume::nvmeof::target_port\": {\"get_param\": \"CinderNVMeOFTargetPort\"}, \"tripleo::profile::base::cinder::volume::nvmeof::target_helper\": {\"get_param\": \"CinderNVMeOFTargetHelper\"}, \"tripleo::profile::base::cinder::volume::nvmeof::target_protocol\": {\"get_param\": \"CinderNVMeOFTargetProtocol\"}, \"tripleo::profile::base::cinder::volume::nvmeof::target_prefix\": {\"get_param\": \"CinderNVMeOFTargetPrefix\"}, \"tripleo::profile::base::cinder::volume::nvmeof::nvmet_port_id\": {\"get_param\": \"CinderNVMeOFTargetPortId\"}, \"tripleo::profile::base::cinder::volume::nvmeof::nvmet_ns_id\": {\"get_param\": \"CinderNVMeOFTargetNameSpaceId\"}, \"tripleo::profile::base::cinder::volume::nvmeof::target_ip_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderIscsiNetwork\"]}}}}, \"cinder::backend::nvmeof::volume_backend_name\": {\"get_param\": \"CinderNVMeOFBackendName\"}}, {\"if\": [{\"not\": {\"equals\": [{\"get_param\": \"CinderNVMeOFAvailabilityZone\"}, \"\"]}}, {\"tripleo::profile::base::cinder::volume::nvmeof::backend_availability_zone\": {\"get_param\": \"CinderNVMeOFAvailabilityZone\"}}]}]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Provides the list of common container volumes and environment used by various cinder services.\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"CinderVolumeOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\"}, \"CinderBackupOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\"}, \"CinderVolumeOptEnvVars\": {\"default\": {}, \"description\": \"hash of optional environment variables\", \"type\": \"json\"}, \"CinderEnableIscsiBackend\": {\"default\": true, \"description\": \"Whether to enable or not the Iscsi backend for Cinder\", \"type\": \"boolean\"}, \"CinderEnableNVMeOFBackend\": {\"default\": false, \"description\": \"Whether to enable or not the NVMeOF backend for Cinder\", \"type\": \"boolean\"}, \"CinderLVMConfigureVG\": {\"default\": true, \"description\": \"Whether to configure the 'cinder-volumes' VG used by the LVM driver. When disabled (set to False), the LVM driver will work as long as the 'cinder-volumes' VG has been created through some other means.\\n\", \"type\": \"boolean\"}, \"CinderLVMLoopDeviceSize\": {\"default\": 10280, \"description\": \"The size of the loopback file used by the cinder LVM driver.\", \"type\": \"number\"}, \"MultipathdEnable\": {\"default\": false, \"description\": \"Whether to enable the multipath daemon\", \"type\": \"boolean\"}, \"CinderVolumeCluster\": {\"default\": \"\", \"description\": \"The cluster name used for deploying the cinder-volume service in an active-active (A/A) configuration. This configuration requires the Cinder backend drivers support A/A, and the cinder-volume service not be managed by pacemaker. If these criteria are not met then the cluster name must be left blank.\\n\", \"type\": \"string\"}, \"CinderImageConversionNfsShare\": {\"default\": \"\", \"description\": \"When set, the NFS share to be used for Cinder's image conversion directory.\", \"type\": \"string\"}, \"CinderImageConversionNfsOptions\": {\"default\": \"_netdev,bg,intr,context=system_u:object_r:container_file_t:s0\", \"description\": \"NFS mount options when using an NFS share for Cinder's image conversion directory.\", \"type\": \"string\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"EnableEtcdInternalTLS\": {\"description\": \"Controls whether etcd and the cinder-volume service use TLS for cinder's lock manager, even when the rest of the internal API network is using TLS.\", \"type\": \"boolean\", \"default\": true}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephExternalMultiConfig\": {\"type\": \"json\", \"hidden\": true, \"description\": \"List of maps describing extra overrides which will be applied when configuring\\nextra external Ceph clusters. If this list is non-empty, ceph-ansible will run\\nan extra count(list) times using the same parameters as the first run except\\neach parameter within each map will override the defaults. If the following\\nwere used, the second run would configure the overcloud to also use the ceph2\\ncluster with all the previous parameters except /etc/ceph/ceph2.conf would have\\na mon_host entry containing the value of external_cluster_mon_ips below, and\\nnot the default CephExternalMonHost. Subsequent ceph-ansible runs are restricted\\nto just ceph clients. CephExternalMultiConfig may not be used to deploy additional\\ninternal Ceph clusters within one Heat stack. The map for each list should contain\\nnot tripleo-heat-template parameters but ceph-ansible parameters.\\n  - cluster: 'ceph2'\\n    fsid: 'e2cba068-5f14-4b0f-b047-acf375c0004a'\\n    external_cluster_mon_ips: '172.18.0.5,172.18.0.6,172.18.0.7'\\n    keys:\\n      - name: \\\"client.openstack\\\"\\n        caps:\\n          mgr: \\\"allow *\\\"\\n          mon: \\\"profile rbd\\\"\\n          osd: \\\"osd: profile rbd pool=volumes, profile rbd pool=backups, profile rbd pool=vms, profile rbd pool=images\\\"\\n        key: \\\"AQCwmeRcAAAAABAA6SQU/bGqFjlfLro5KxrB1Q==\\\"\\n        mode: \\\"0600\\\"\\n    dashboard_enabled: false\\n\", \"default\": []}}, \"conditions\": {\"cvol_active_active_tls_enabled\": {\"and\": [{\"not\": {\"equals\": [{\"get_param\": \"CinderVolumeCluster\"}, \"\"]}}, {\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"EnableEtcdInternalTLS\"}]}, \"cinder_nfs_conversion_dir_enabled\": {\"not\": {\"equals\": [{\"get_param\": \"CinderImageConversionNfsShare\"}, \"\"]}}, \"cinder_configure_lvm\": {\"and\": [{\"get_param\": \"CinderLVMConfigureVG\"}, {\"or\": [{\"get_param\": \"CinderEnableIscsiBackend\"}, {\"get_param\": \"CinderEnableNVMeOFBackend\"}]}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"CinderNVMeOF\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backend-nvmeof-puppet.yaml\"}}, \"outputs\": {\"cinder_image_conversion_nfs_dir\": {\"description\": \"The directory where cinder does its image conversion when the directory is backed by an NFS share.\", \"value\": \"/var/lib/cinder_image_conversion\"}, \"cinder_common_host_prep_tasks\": {\"description\": \"Common host prep tasks for cinder-volume and cinder-backup services\", \"value\": {\"list_concat\": [[{\"name\": \"create fcontext entry for cinder data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/cinder(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/cinder\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/cinder\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}], {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_host_prep_tasks\"]}]}}, \"cinder_common_volumes\": {\"description\": \"Common volumes for all cinder services\", \"value\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/cinder:/var/log/cinder:z\"], {\"if\": [\"cvol_active_active_tls_enabled\", [\"/etc/pki/tls/certs/etcd.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/etcd.crt:ro\", \"/etc/pki/tls/private/etcd.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/etcd.key:ro\"]]}]}}, \"cinder_common_kolla_config_files\": {\"description\": \"Common kolla config_files for cinder-volume and cinder-backup services\", \"value\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-iscsid/*\", \"dest\": \"/etc/iscsi/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}]}, \"cinder_common_kolla_permissions\": {\"description\": \"Common kolla permissions for cinder-volume and cinder-backup services\", \"value\": {\"list_concat\": [[{\"path\": \"/var/log/cinder\", \"owner\": \"cinder:cinder\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"cinder:cinder\", \"perm\": \"0600\"}, {\"path\": \"/etc/pki/tls/certs/etcd.crt\", \"owner\": \"cinder:cinder\"}, {\"path\": \"/etc/pki/tls/private/etcd.key\", \"owner\": \"cinder:cinder\"}], {\"repeat\": {\"template\": {\"path\": \"/etc/ceph/<%cluster%>.client.*.keyring\", \"owner\": \"cinder:cinder\", \"perm\": \"0600\"}, \"for_each\": {\"<%cluster%>\": {\"yaql\": {\"expression\": \"$.data.multiconfig.select($.cluster)\", \"data\": {\"multiconfig\": {\"get_param\": \"CephExternalMultiConfig\"}}}}}}}]}}, \"cinder_volume_host_prep_and_system_upgrade_post_tasks\": {\"description\": \"Common host_prep and system_upgrade post tasks for cinder-volume\", \"value\": [{\"name\": \"Support using an NFS share for cinder image conversion\", \"vars\": {\"image_conversion_nfs_enabled\": {\"if\": [\"cinder_nfs_conversion_dir_enabled\", true, false]}}, \"when\": [\"image_conversion_nfs_enabled|bool\"], \"block\": [{\"name\": \"Create cinder image conversion directory\", \"file\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"directory\"}}, {\"name\": \"Mount cinder's image conversion NFS share\", \"vars\": {\"image_conversion_nfs_share\": {\"get_param\": \"CinderImageConversionNfsShare\"}, \"image_conversion_nfs_options\": {\"get_param\": \"CinderImageConversionNfsOptions\"}}, \"mount\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"mounted\", \"fstype\": \"nfs4\", \"src\": \"{{ image_conversion_nfs_share }}\", \"opts\": \"{{ image_conversion_nfs_options }}\"}}]}]}, \"cinder_volume_host_prep_tasks\": {\"description\": \"Host prep tasks for the cinder-volume service (HA or non-HA)\", \"value\": {\"list_concat\": [{\"list_concat\": [[{\"name\": \"create fcontext entry for cinder data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/cinder(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/cinder\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/cinder\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}], {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_host_prep_tasks\"]}]}, [{\"name\": \"Support using an NFS share for cinder image conversion\", \"vars\": {\"image_conversion_nfs_enabled\": {\"if\": [\"cinder_nfs_conversion_dir_enabled\", true, false]}}, \"when\": [\"image_conversion_nfs_enabled|bool\"], \"block\": [{\"name\": \"Create cinder image conversion directory\", \"file\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"directory\"}}, {\"name\": \"Mount cinder's image conversion NFS share\", \"vars\": {\"image_conversion_nfs_share\": {\"get_param\": \"CinderImageConversionNfsShare\"}, \"image_conversion_nfs_options\": {\"get_param\": \"CinderImageConversionNfsOptions\"}}, \"mount\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"mounted\", \"fstype\": \"nfs4\", \"src\": \"{{ image_conversion_nfs_share }}\", \"opts\": \"{{ image_conversion_nfs_options }}\"}}]}], [{\"name\": \"cinder_configure_lvm fact\", \"set_fact\": {\"cinder_configure_lvm\": {\"if\": [\"cinder_configure_lvm\", true, false]}}}, {\"when\": \"cinder_configure_lvm|bool\", \"block\": [{\"name\": \"ensure LVM rpm dependencies are installed\", \"package\": {\"name\": \"lvm2\", \"state\": \"latest\"}}, {\"name\": \"cinder create LVM volume group dd\", \"command\": {\"list_join\": [\"\", [\"dd if=/dev/zero of=/var/lib/cinder/cinder-volumes bs=1 count=0 seek=\", {\"str_replace\": {\"template\": \"VALUE\", \"params\": {\"VALUE\": {\"get_param\": \"CinderLVMLoopDeviceSize\"}}}}, \"M\"]]}, \"args\": {\"creates\": \"/var/lib/cinder/cinder-volumes\"}}, {\"name\": \"Get or create LVM loopback device\", \"shell\": \"exit_code=0\\nexisting_device=$(losetup -j /var/lib/cinder/cinder-volumes -l -n -O NAME)\\nif [[ -z \\\"${existing_device}\\\" ]]; then\\n    losetup -f /var/lib/cinder/cinder-volumes --show\\n    exit_code=2\\nelse\\n    echo ${existing_device%$'\\\\n'*}\\nfi\\nexit ${exit_code}\", \"args\": {\"executable\": \"/bin/bash\"}, \"register\": \"_loopback_device\", \"changed_when\": \"_loopback_device.rc == 2\", \"failed_when\": \"_loopback_device.rc not in [0,2]\"}, {\"name\": \"Create LVM volume group\", \"community.general.lvg\": {\"vg\": \"cinder-volumes\", \"pvs\": \"{{ _loopback_device.stdout }}\", \"state\": \"present\"}, \"when\": [\"not (ansible_check_mode | bool)\"]}, {\"name\": \"cinder create service to run losetup for LVM on startup\", \"copy\": {\"dest\": \"/etc/systemd/system/cinder-lvm-losetup.service\", \"content\": \"[Unit]\\nDescription=Cinder LVM losetup\\nDefaultDependencies=no\\nConflicts=umount.target\\nRequires=lvm2-monitor.service systemd-udev-settle.service\\nBefore=local-fs.target umount.target\\nAfter=var.mount lvm2-monitor.service systemd-udev-settle.service\\n\\n[Service]\\nType=oneshot\\nExecStart=/sbin/losetup {{ _loopback_device.stdout }} /var/lib/cinder/cinder-volumes\\nExecStop=/sbin/losetup -d {{ _loopback_device.stdout }}\\nRemainAfterExit=yes\\n\\n[Install]\\nWantedBy=local-fs-pre.target\\n\"}, \"when\": [\"not (ansible_check_mode | bool)\"]}, {\"name\": \"cinder enable the LVM losetup service\", \"systemd\": {\"name\": \"cinder-lvm-losetup\", \"enabled\": true, \"daemon_reload\": true}}]}]]}}, \"cinder_volume_upgrade_tasks\": {\"description\": \"Upgrade tasks for the cinder-volume service (HA or non-HA)\", \"value\": [{\"name\": \"cinder-volume pre system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 3\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Unmount cinder's image conversion NFS share\", \"vars\": {\"image_conversion_nfs_share\": {\"get_param\": \"CinderImageConversionNfsShare\"}, \"image_conversion_nfs_options\": {\"get_param\": \"CinderImageConversionNfsOptions\"}, \"image_conversion_nfs_enabled\": {\"if\": [\"cinder_nfs_conversion_dir_enabled\", true, false]}}, \"when\": \"image_conversion_nfs_enabled|bool\", \"mount\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"absent\", \"fstype\": \"nfs4\"}}]}, {\"name\": \"cinder-volume post system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 5\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Support using an NFS share for cinder image conversion\", \"vars\": {\"image_conversion_nfs_enabled\": {\"if\": [\"cinder_nfs_conversion_dir_enabled\", true, false]}}, \"when\": [\"image_conversion_nfs_enabled|bool\"], \"block\": [{\"name\": \"Create cinder image conversion directory\", \"file\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"directory\"}}, {\"name\": \"Mount cinder's image conversion NFS share\", \"vars\": {\"image_conversion_nfs_share\": {\"get_param\": \"CinderImageConversionNfsShare\"}, \"image_conversion_nfs_options\": {\"get_param\": \"CinderImageConversionNfsOptions\"}}, \"mount\": {\"path\": \"/var/lib/cinder_image_conversion\", \"state\": \"mounted\", \"fstype\": \"nfs4\", \"src\": \"{{ image_conversion_nfs_share }}\", \"opts\": \"{{ image_conversion_nfs_options }}\"}}]}]}]}, \"cinder_volume_config_settings\": {\"description\": \"Config settings for the cinder-volume container (HA or non-HA)\", \"value\": {\"if\": [\"cinder_nfs_conversion_dir_enabled\", {\"cinder::image_conversion_dir\": \"/var/lib/cinder_image_conversion\"}, {}]}}, \"cinder_volume_volumes\": {\"description\": \"Volumes for the cinder-volume container (HA or non-HA)\", \"value\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/cinder:/var/log/cinder:z\"], {\"if\": [\"cvol_active_active_tls_enabled\", [\"/etc/pki/tls/certs/etcd.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/etcd.crt:ro\", \"/etc/pki/tls/private/etcd.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/etcd.key:ro\"]]}]}, {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_volumes\"]}, {\"get_param\": \"CinderVolumeOptVolumes\"}, [\"/var/lib/kolla/config_files/cinder_volume.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, \"/lib/modules:/lib/modules:ro\", \"/dev:/dev\", \"/run:/run\", \"/sys:/sys\", \"/var/lib/cinder:/var/lib/cinder:z\", \"/var/lib/iscsi:/var/lib/iscsi:z\"], {\"if\": [{\"get_param\": \"CinderEnableIscsiBackend\"}, [\"/etc/target:/etc/target:z\"]]}, {\"if\": [{\"get_param\": \"MultipathdEnable\"}, [\"/etc/multipath:/etc/multipath:z\", \"/etc/multipath.conf:/etc/multipath.conf:ro\"]]}, {\"if\": [\"cinder_nfs_conversion_dir_enabled\", [{\"str_replace\": {\"template\": \"DIR:DIR:slave\", \"params\": {\"DIR\": \"/var/lib/cinder_image_conversion\"}}}]]}]}}, \"cinder_volume_environment\": {\"description\": \"Docker environment for the cinder-volume container (HA or non-HA)\", \"value\": {\"map_merge\": [{\"get_param\": \"CinderVolumeOptEnvVars\"}, {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}]}}, \"cinder_backup_host_prep_tasks\": {\"description\": \"Host prep tasks for the cinder-backup service (HA or non-HA)\", \"value\": {\"list_concat\": [[{\"name\": \"create fcontext entry for cinder data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/cinder(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/cinder\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/cinder\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}], {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_host_prep_tasks\"]}]}}, \"cinder_backup_volumes\": {\"description\": \"Volumes for the cinder-backup container (HA or non-HA)\", \"value\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/cinder:/var/log/cinder:z\"], {\"if\": [\"cvol_active_active_tls_enabled\", [\"/etc/pki/tls/certs/etcd.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/etcd.crt:ro\", \"/etc/pki/tls/private/etcd.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/etcd.key:ro\"]]}]}, {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_volumes\"]}, {\"get_param\": \"CinderBackupOptVolumes\"}, [\"/var/lib/kolla/config_files/cinder_backup.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, \"/dev:/dev\", \"/run:/run\", \"/sys:/sys\", \"/lib/modules:/lib/modules:ro\", \"/var/lib/cinder:/var/lib/cinder:z\", \"/var/lib/iscsi:/var/lib/iscsi:z\"], {\"if\": [{\"get_param\": \"MultipathdEnable\"}, [\"/etc/multipath:/etc/multipath:z\"]]}]}}, \"cinder_backup_environment\": {\"description\": \"Docker environment for the cinder-backup container (HA or non-HA)\", \"value\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Cinder API service\\n\", \"parameters\": {\"ContainerCinderApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCinderConfigImage\": {\"description\": \"The container image to use for the cinder config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"CinderApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.cinder.api\", \"file\": \"/var/log/containers/cinder/cinder-api.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"CinderDefaultVolumeType\": {\"default\": \"tripleo\", \"description\": \"The name of Cinder's default volume type.\", \"type\": \"string\", \"constraints\": [{\"allowed_pattern\": \".*\\\\S.*\", \"description\": \"The default volume type name cannot be empty.\\n\"}]}, \"CinderEnableDBPurge\": {\"default\": true, \"description\": \"Whether to create cron job for purging soft deleted rows in Cinder database.\\n\", \"type\": \"boolean\"}, \"CinderPassword\": {\"description\": \"The password for the cinder service and db account.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionCinderApi\": {\"default\": \"overcloud-cinder-api\", \"type\": \"string\"}, \"CinderWorkers\": {\"type\": \"string\", \"description\": \"Set the number of workers for cinder::wsgi::apache\", \"default\": \"%{::os_workers}\"}, \"CinderApiPolicies\": {\"description\": \"A hash of policies to configure for Cinder API.\\ne.g. { cinder-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"CinderApiWsgiTimeout\": {\"default\": 60, \"description\": \"The number of seconds until a Cinder API WSGI connection times out.\", \"type\": \"number\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"AuthCloudName\": {\"description\": \"Entry in clouds.yaml to use for authentication\", \"type\": \"string\", \"default\": \"\"}}, \"conditions\": {\"auth_cloud_name_set\": {\"not\": {\"equals\": [{\"get_param\": \"AuthCloudName\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"CinderBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"CinderCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml\"}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCinderApiImage\": \"ContainerCinderApiImage\", \"ContainerCinderConfigImage\": \"ContainerCinderConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCinderApiImage\": {\"get_param\": \"ContainerCinderApiImage\"}, \"ContainerCinderConfigImage\": {\"get_param\": \"ContainerCinderConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder API role.\", \"value\": {\"service_name\": \"cinder_api\", \"firewall_rules\": {\"119 cinder\": {\"dport\": [8776]}}, \"firewall_frontend_rules\": {\"100 cinder_haproxy_frontend\": {\"dport\": [8776]}}, \"firewall_ssl_frontend_rules\": {\"100 cinder_haproxy_frontend_ssl\": {\"dport\": [13776]}}, \"keystone_resources\": {\"cinder\": {\"users\": {\"cinder\": {\"password\": {\"get_param\": \"CinderPassword\"}, \"roles\": [\"admin\", \"service\"]}}}, \"cinderv3\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"CinderV3Public\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"CinderV3Internal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"CinderV3Admin\", \"uri\"]}}, \"users\": {\"cinderv3\": {\"password\": {\"get_param\": \"CinderPassword\"}, \"roles\": [\"admin\", \"service\"]}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"volumev3\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCinderApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CinderBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"keystone_resources_managed\": false}, {\"cinder::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"cinder::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"cinder::keystone::authtoken::password\": {\"get_param\": \"CinderPassword\"}, \"cinder::keystone::authtoken::project_name\": \"service\", \"cinder::keystone::authtoken::user_domain_name\": \"Default\", \"cinder::keystone::authtoken::project_domain_name\": \"Default\", \"cinder::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"cinder::keystone::authtoken::interface\": \"internal\", \"cinder::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"cinder::policy::policies\": {\"get_param\": \"CinderApiPolicies\"}, \"cinder::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"cinder::api::default_volume_type\": {\"get_param\": \"CinderDefaultVolumeType\"}, \"cinder::api::enable_proxy_headers_parsing\": true, \"tripleo::profile::base::cinder::cinder_enable_db_purge\": {\"get_param\": \"CinderEnableDBPurge\"}, \"cinder::api::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}}}, \"cinder::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"cinder::api::service_name\": \"httpd\", \"cinder::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}}}, \"cinder::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderApiNetwork\"]}}}}, \"cinder::wsgi::apache::vhost_custom_fragment\": {\"str_replace\": {\"template\": \"Timeout TIMEOUT\", \"params\": {\"TIMEOUT\": {\"get_param\": \"CinderApiWsgiTimeout\"}}}}, \"cinder::wsgi::apache::workers\": {\"get_param\": \"CinderWorkers\"}}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_cinder_api\": [{\"get_param\": \"CinderApiLoggingSource\"}]}, \"mysql\": {\"cinder::db::mysql::password\": {\"get_param\": \"CinderPassword\"}, \"cinder::db::mysql::user\": \"cinder\", \"cinder::db::mysql::host\": \"%\", \"cinder::db::mysql::dbname\": \"cinder\"}}, \"puppet_config\": {\"config_volume\": \"cinder\", \"puppet_tags\": \"cinder_config,file,concat,file_line,cinder_api_paste_ini\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::cinder::api\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/cinder_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/cinder\", \"owner\": \"cinder:cinder\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/etcd.crt\", \"owner\": \"cinder:cinder\"}, {\"path\": \"/etc/pki/tls/private/etcd.key\", \"owner\": \"cinder:cinder\"}]}, \"/var/lib/kolla/config_files/cinder_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec cinder_api su cinder -s /bin/bash -c 'cinder-manage db sync --bump-versions'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/cinder\", \"owner\": \"cinder:cinder\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/etcd.crt\", \"owner\": \"cinder:cinder\"}, {\"path\": \"/etc/pki/tls/private/etcd.key\", \"owner\": \"cinder:cinder\"}]}, \"/var/lib/kolla/config_files/cinder_api_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/cinder\", \"owner\": \"cinder:cinder\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"cinder_api_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderApiImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/cinder:/var/log/cinder:z\", \"/var/log/containers/httpd/cinder-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R cinder:cinder /var/log/cinder\"]}}, \"step_3\": {\"cinder_api_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"privileged\": false, \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/cinder_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/cinder:/var/log/cinder:z\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"cinder_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderApiImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"user\": \"root\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/cinder_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/cinder:/var/log/cinder:z\", \"/var/log/containers/httpd/cinder-api:/var/log/httpd:z\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"cinder_api_cron\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron cinder\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/cinder_api_cron.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/cinder:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/cinder:/var/log/cinder:z\", \"/var/log/containers/httpd/cinder-api:/var/log/httpd:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/cinder\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/cinder-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"external_upgrade_tasks\": [{\"when\": \"step|int == 1\", \"block\": [{\"name\": \"Online data migration for Cinder\", \"command\": \"{{ container_cli }} exec cinder_api cinder-manage db online_data_migrations\", \"delegate_to\": \"{{ (groups['cinder_api'] | difference(groups['excluded_overcloud']))[0] }}\", \"become\": true, \"tags\": [\"online_upgrade\", \"online_upgrade_cinder\"]}]}, {\"when\": \"step|int == 1\", \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop cinder api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"cinder_api\", \"cinder_api_cron\"], \"tripleo_delegate_to\": \"{{ groups['cinder_api'] | difference(groups['excluded_overcloud']) }}\"}}]}], \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"block\": [{\"name\": \"Online data migration for Cinder\", \"command\": \"{{ container_cli }} exec cinder_api cinder-manage db online_data_migrations\", \"delegate_to\": \"{{ (groups['cinder_api'] | difference(groups['excluded_overcloud']))[0] }}\", \"become\": true, \"tags\": [\"online_upgrade\", \"online_upgrade_cinder\"]}]}], \"external_deploy_tasks\": [{\"name\": \"Clean up legacy Cinder keystone catalog entries\", \"become\": true, \"openstack.cloud.catalog_service\": {\"cloud\": {\"if\": [\"auth_cloud_name_set\", {\"get_param\": \"AuthCloudName\"}, {\"get_param\": \"RootStackName\"}]}, \"name\": \"{{ item.service_name }}\", \"service_type\": \"{{ item.service_type }}\", \"state\": \"absent\"}, \"loop\": [{\"service_name\": \"cinderv2\", \"service_type\": \"volumev2\"}, {\"service_name\": \"cinderv3\", \"service_type\": \"volume\"}], \"loop_control\": {\"index_var\": \"cinder_api_service\"}, \"when\": [\"step|int == 4\", \"not ansible_check_mode|bool\"]}, {\"name\": \"Manage Cinder's default volume type\", \"become\": true, \"vars\": {\"default_volume_type\": {\"get_param\": \"CinderDefaultVolumeType\"}}, \"environment\": {\"OS_CLOUD\": {\"if\": [\"auth_cloud_name_set\", {\"get_param\": \"AuthCloudName\"}, {\"get_param\": \"RootStackName\"}]}}, \"when\": [\"step|int == 5\", \"not ansible_check_mode|bool\"], \"shell\": \"if ! openstack volume type show \\\"{{ default_volume_type }}\\\"; then\\n    openstack volume type create --public \\\"{{ default_volume_type }}\\\"\\nfi\\neval $(openstack volume type show __DEFAULT__ -f shell -c id -c description)\\nif [ -n \\\"$id\\\" ]; then\\n    if ! openstack volume type delete $id ; then\\n        tripleo_descr=\\\"For internal use, '{{ default_volume_type }}' is the default volume type\\\"\\n        if [ \\\"$description\\\" != \\\"$tripleo_descr\\\" ]; then\\n            openstack volume type set $id --description \\\"$tripleo_descr\\\"\\n        fi\\n    fi\\nfi\\n\", \"args\": {\"executable\": \"/bin/bash\"}, \"changed_when\": false}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-scheduler-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Cinder Scheduler service\\n\", \"parameters\": {\"ContainerCinderSchedulerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCinderConfigImage\": {\"description\": \"The container image to use for the cinder config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"CinderSchedulerLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.cinder.scheduler\", \"file\": \"/var/log/containers/cinder/cinder-scheduler.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionCinderScheduler\": {\"default\": \"overcloud-cinder-scheduler\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"CinderBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"CinderCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCinderSchedulerImage\": \"ContainerCinderSchedulerImage\", \"ContainerCinderConfigImage\": \"ContainerCinderConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCinderSchedulerImage\": {\"get_param\": \"ContainerCinderSchedulerImage\"}, \"ContainerCinderConfigImage\": {\"get_param\": \"ContainerCinderConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder Scheduler role.\", \"value\": {\"service_name\": \"cinder_scheduler\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCinderScheduler\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CinderBase\", \"role_data\", \"config_settings\"]}, {\"cinder::scheduler::scheduler_driver\": \"cinder.scheduler.filter_scheduler.FilterScheduler\"}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_cinder_scheduler\": [{\"get_param\": \"CinderSchedulerLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"cinder\", \"puppet_tags\": \"cinder_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::cinder::scheduler\"], [{\"get_attr\": [\"CinderBase\", \"role_data\", \"step_config\"]}, {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/cinder_scheduler.json\": {\"command\": \"/usr/bin/cinder-scheduler --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/cinder\", \"owner\": \"cinder:cinder\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/etcd.crt\", \"owner\": \"cinder:cinder\"}, {\"path\": \"/etc/pki/tls/private/etcd.key\", \"owner\": \"cinder:cinder\"}]}}, \"docker_config\": {\"step_2\": {\"cinder_scheduler_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderSchedulerImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/cinder:/var/log/cinder:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R cinder:cinder /var/log/cinder\"]}}, \"step_4\": {\"cinder_scheduler\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderSchedulerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"CinderCommon\", \"cinder_common_volumes\"]}, [\"/var/lib/kolla/config_files/cinder_scheduler.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/cinder\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop cinder scheduler container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"cinder_scheduler\"], \"tripleo_delegate_to\": \"{{ groups['cinder_scheduler'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-volume-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Cinder Volume service\\n\", \"parameters\": {\"ContainerCinderVolumeImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCinderConfigImage\": {\"description\": \"The container image to use for the cinder config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"DockerCinderVolumeUlimit\": {\"default\": [\"nofile=131072\"], \"description\": \"ulimit for Cinder Volume Container\", \"type\": \"comma_delimited_list\"}, \"CinderVolumeLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.cinder.volume\", \"file\": \"/var/log/containers/cinder/cinder-volume.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CinderVolumeCluster\": {\"default\": \"\", \"description\": \"The cluster name used for deploying the cinder-volume service in an active-active (A/A) configuration. This configuration requires the Cinder backend drivers support A/A, and the cinder-volume service not be managed by pacemaker. If these criteria are not met then the cluster name must be left blank.\\n\", \"type\": \"string\"}, \"CinderEnableNfsBackend\": {\"default\": false, \"description\": \"Whether to enable or not the NFS backend for Cinder\", \"type\": \"boolean\"}, \"CinderEnableIscsiBackend\": {\"default\": true, \"description\": \"Whether to enable or not the Iscsi backend for Cinder\", \"type\": \"boolean\"}, \"CinderEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable or not the Rbd backend for Cinder\", \"type\": \"boolean\"}, \"CinderISCSIAvailabilityZone\": {\"default\": \"\", \"description\": \"The availability zone of the Iscsi Cinder backend. When set, it overrides the default CinderStorageAvailabilityZone.\\n\", \"type\": \"string\"}, \"CinderISCSIHelper\": {\"default\": \"lioadm\", \"description\": \"The iSCSI helper to use with cinder.\", \"type\": \"string\"}, \"CinderISCSIProtocol\": {\"default\": \"iscsi\", \"description\": \"Whether to use TCP ('iscsi') or iSER RDMA ('iser') for iSCSI\", \"type\": \"string\"}, \"CinderNfsAvailabilityZone\": {\"default\": \"\", \"description\": \"The availability zone of the NFS Cinder backend. When set, it overrides the default CinderStorageAvailabilityZone.\\n\", \"type\": \"string\"}, \"CinderNfsMountOptions\": {\"default\": \"context=system_u:object_r:container_file_t:s0\", \"description\": \"Mount options for NFS mounts used by Cinder NFS backend. Effective when CinderEnableNfsBackend is true.\\n\", \"type\": \"string\"}, \"CinderNfsServers\": {\"default\": \"\", \"description\": \"NFS servers used by Cinder NFS backend. Effective when CinderEnableNfsBackend is true.\\n\", \"type\": \"comma_delimited_list\"}, \"CinderNfsSnapshotSupport\": {\"default\": false, \"description\": \"Whether to enable support for snapshots in the NFS driver. Effective when CinderEnableNfsBackend is true.\\n\", \"type\": \"boolean\"}, \"CinderNasSecureFileOperations\": {\"default\": false, \"description\": \"Controls whether security enhanced NFS file operations are enabled. Valid values are 'auto', 'true' or 'false'. Effective when CinderEnableNfsBackend is true.\\n\", \"type\": \"string\"}, \"CinderNasSecureFilePermissions\": {\"default\": false, \"description\": \"Controls whether security enhanced NFS file permissions are enabled. Valid values are 'auto', 'true' or 'false'. Effective when CinderEnableNfsBackend is true.\\n\", \"type\": \"string\"}, \"CinderRbdBackendName\": {\"type\": \"comma_delimited_list\", \"default\": \"tripleo_ceph\", \"description\": \"A list of Cinder RBD backend names.\"}, \"CinderRbdAvailabilityZone\": {\"default\": \"\", \"description\": \"The availability zone of the RBD Cinder backend. When set, it overrides the default CinderStorageAvailabilityZone.\\n\", \"type\": \"string\"}, \"CinderRbdPoolName\": {\"default\": \"volumes\", \"type\": \"string\"}, \"CinderRbdExtraPools\": {\"default\": [], \"description\": \"List of extra Ceph pools for use with RBD backends for Cinder. An extra Cinder RBD backend driver is created for each pool in the list. This is in addition to the standard RBD backend driver associated with the CinderRbdPoolName.\\n\", \"type\": \"comma_delimited_list\"}, \"CinderRbdFlattenVolumeFromSnapshot\": {\"default\": false, \"description\": \"Whether RBD volumes created from a snapshot should be flattened in order to remove a dependency on the snapshot.\\n\", \"type\": \"boolean\"}, \"CinderRbdMultiConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring multiple RBD backends. The\\nhash key is the backend name, and the value is a dictionary of parameter\\nvalues unique to that backend. The following parameters are required,\\nand must match the corresponding value defined in CephExternalMultiConfig.\\n  CephClusterName (must match the CephExternalMultiConfig entry's 'cluster')\\n  CephClusterFSID (must match the CephExternalMultiConfig entry's 'fsid')\\nThe following parameters are optional, and override the corresponding\\nparameter's default value.\\n  CephClientUserName\\n  CinderRbdPoolName\\n  CinderRbdExtraPools\\n  CinderRbdAvailabilityZone\\n  CinderRbdFlattenVolumeFromSnapshot\\n\"}, \"CephClusterFSID\": {\"type\": \"string\", \"description\": \"The Ceph cluster FSID. Must be a UUID.\"}, \"MonitoringSubscriptionCinderVolume\": {\"default\": \"overcloud-cinder-volume\", \"type\": \"string\"}, \"CinderEtcdLocalConnect\": {\"default\": false, \"type\": \"boolean\", \"description\": \"When running Cinder A/A, whether to connect to Etcd via the local IP for the Etcd network. If set to true, the ip on the local node will be used. If set to false, the VIP on the Etcd network will be used instead. Defaults to false.\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"EnableEtcdInternalTLS\": {\"description\": \"Controls whether etcd and the cinder-volume service use TLS for cinder's lock manager, even when the rest of the internal API network is using TLS.\", \"type\": \"boolean\", \"default\": true}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"conditions\": {\"cvol_active_active_tls_enabled\": {\"and\": [{\"not\": {\"equals\": [{\"get_param\": \"CinderVolumeCluster\"}, \"\"]}}, {\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"EnableEtcdInternalTLS\"}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"CinderBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"CinderCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCinderVolumeImage\": \"ContainerCinderVolumeImage\", \"ContainerCinderConfigImage\": \"ContainerCinderConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCinderVolumeImage\": {\"get_param\": \"ContainerCinderVolumeImage\"}, \"ContainerCinderConfigImage\": {\"get_param\": \"ContainerCinderConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder Volume role.\", \"value\": {\"service_name\": \"cinder_volume\", \"firewall_rules\": {\"120 iscsi initiator\": {\"dport\": 3260}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCinderVolume\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CinderBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"CinderCommon\", \"cinder_volume_config_settings\"]}, {\"tripleo::profile::base::lvm::enable_udev\": false, \"tripleo::profile::base::cinder::volume::cinder_enable_iscsi_backend\": {\"get_param\": \"CinderEnableIscsiBackend\"}, \"tripleo::profile::base::cinder::volume::cinder_enable_nfs_backend\": {\"get_param\": \"CinderEnableNfsBackend\"}, \"tripleo::profile::base::cinder::volume::cinder_enable_rbd_backend\": {\"get_param\": \"CinderEnableRbdBackend\"}, \"tripleo::profile::base::cinder::volume::cinder_volume_cluster\": {\"get_param\": \"CinderVolumeCluster\"}, \"tripleo::profile::base::cinder::volume::nfs::cinder_nfs_mount_options\": {\"get_param\": \"CinderNfsMountOptions\"}, \"tripleo::profile::base::cinder::volume::nfs::cinder_nfs_servers\": {\"get_param\": \"CinderNfsServers\"}, \"tripleo::profile::base::cinder::volume::nfs::cinder_nfs_snapshot_support\": {\"get_param\": \"CinderNfsSnapshotSupport\"}, \"tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_operations\": {\"get_param\": \"CinderNasSecureFileOperations\"}, \"tripleo::profile::base::cinder::volume::nfs::cinder_nas_secure_file_permissions\": {\"get_param\": \"CinderNasSecureFilePermissions\"}, \"tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_helper\": {\"get_param\": \"CinderISCSIHelper\"}, \"tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_protocol\": {\"get_param\": \"CinderISCSIProtocol\"}, \"tripleo::profile::base::cinder::volume::rbd::backend_name\": {\"get_param\": \"CinderRbdBackendName\"}, \"tripleo::profile::base::cinder::volume::rbd::cinder_rbd_ceph_conf\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"tripleo::profile::base::cinder::volume::rbd::cinder_rbd_pool_name\": {\"get_param\": \"CinderRbdPoolName\"}, \"tripleo::profile::base::cinder::volume::rbd::cinder_rbd_extra_pools\": {\"get_param\": \"CinderRbdExtraPools\"}, \"tripleo::profile::base::cinder::volume::rbd::cinder_rbd_secret_uuid\": {\"get_param\": \"CephClusterFSID\"}, \"tripleo::profile::base::cinder::volume::rbd::cinder_rbd_user_name\": {\"get_param\": \"CephClientUserName\"}, \"tripleo::profile::base::cinder::volume::rbd::cinder_rbd_flatten_volume_from_snapshot\": {\"get_param\": \"CinderRbdFlattenVolumeFromSnapshot\"}, \"tripleo::profile::base::cinder::volume::rbd::multi_config\": {\"get_param\": \"CinderRbdMultiConfig\"}, \"tripleo::profile::base::cinder::volume::iscsi::cinder_iscsi_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CinderIscsiNetwork\"]}}}}}, {\"if\": [{\"not\": {\"equals\": [{\"get_param\": \"CinderISCSIAvailabilityZone\"}, \"\"]}}, {\"tripleo::profile::base::cinder::volume::iscsi::backend_availability_zone\": {\"get_param\": \"CinderISCSIAvailabilityZone\"}}]}, {\"if\": [{\"not\": {\"equals\": [{\"get_param\": \"CinderNfsAvailabilityZone\"}, \"\"]}}, {\"tripleo::profile::base::cinder::volume::nfs::backend_availability_zone\": {\"get_param\": \"CinderNfsAvailabilityZone\"}}]}, {\"if\": [{\"not\": {\"equals\": [{\"get_param\": \"CinderRbdAvailabilityZone\"}, \"\"]}}, {\"tripleo::profile::base::cinder::volume::rbd::backend_availability_zone\": {\"get_param\": \"CinderRbdAvailabilityZone\"}}]}, {\"if\": [{\"get_param\": \"CinderEtcdLocalConnect\"}, {\"tripleo::profile::base::cinder::volume::etcd_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"EtcdNetwork\"]}}}}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_cinder_volume\": [{\"get_param\": \"CinderVolumeLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"cinder\", \"puppet_tags\": \"cinder_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::lvm\", \"include tripleo::profile::base::cinder::volume\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/cinder_volume.json\": {\"command\": \"/usr/bin/cinder-volume --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf\", \"config_files\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_permissions\"]}}}, \"docker_config\": {\"step_3\": {\"cinder_volume_init_logs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/cinder:/var/log/cinder:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R cinder:cinder /var/log/cinder\"]}}, \"step_4\": {\"cinder_volume\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"ulimit\": {\"get_param\": \"DockerCinderVolumeUlimit\"}, \"ipc\": \"host\", \"net\": \"host\", \"privileged\": true, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_volumes\"]}, \"environment\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_environment\"]}}}}, \"host_prep_tasks\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_host_prep_tasks\"]}, \"upgrade_tasks\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_upgrade_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop cinder volume container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"cinder_volume\"], \"tripleo_delegate_to\": \"{{ groups['cinder_volume'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-volume-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Cinder Volume service\\n\", \"parameters\": {\"ContainerCinderVolumeImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCinderConfigImage\": {\"description\": \"The container image to use for the cinder config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"CinderVolumeLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.cinder.volume\", \"file\": \"/var/log/containers/cinder/cinder-volume.log\"}}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"CinderBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-volume-container-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"CinderCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCinderVolumeImage\": \"ContainerCinderVolumeImage\", \"ContainerCinderConfigImage\": \"ContainerCinderConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCinderVolumeImage\": {\"get_param\": \"ContainerCinderVolumeImage\"}, \"ContainerCinderConfigImage\": {\"get_param\": \"ContainerCinderConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder Volume role.\", \"value\": {\"service_name\": \"cinder_volume\", \"firewall_rules\": {\"get_attr\": [\"CinderBase\", \"role_data\", \"firewall_rules\"]}, \"monitoring_subscription\": {\"get_attr\": [\"CinderBase\", \"role_data\", \"monitoring_subscription\"]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CinderBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::profile::base::lvm::enable_udev\": false, \"tripleo::profile::pacemaker::cinder::volume_bundle::cinder_volume_docker_image\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-volume:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"tripleo::profile::pacemaker::cinder::volume_bundle::docker_volumes\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_volumes\"]}, \"tripleo::profile::pacemaker::cinder::volume_bundle::docker_environment\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_environment\"]}, \"tripleo::profile::pacemaker::cinder::volume_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::cinder::volume_bundle::ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"cinder::volume::manage_service\": false, \"cinder::volume::enabled\": false, \"cinder::backend_host\": \"hostgroup\"}]}, \"service_config_settings\": {\"get_attr\": [\"CinderBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"cinder\", \"puppet_tags\": \"cinder_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::lvm\"], [\"include tripleo::profile::pacemaker::cinder::volume_bundle\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/cinder_volume.json\": {\"command\": \"/usr/bin/cinder-volume --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf\", \"config_files\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_permissions\"]}}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_3\": {\"cinder_volume_init_logs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/cinder:/var/log/cinder\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R cinder:cinder /var/log/cinder\"]}}}, \"host_prep_tasks\": {\"get_attr\": [\"CinderCommon\", \"cinder_volume_host_prep_tasks\"]}, \"deploy_steps_tasks\": [{\"name\": \"Cinder Volume tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"container_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-volume:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"Cinder Volume HA Wrappers Step\", \"when\": \"step|int == 5\", \"block\": [{\"name\": \"Cinder volume puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"cinder_volume\", \"tripleo_ha_wrapper_resource_name\": \"openstack-cinder-volume\", \"tripleo_ha_wrapper_bundle_name\": \"openstack-cinder-volume\", \"tripleo_ha_wrapper_resource_state\": \"_ Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"cinder\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::volume_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".cinder_volume_previous_run\"}}]}], \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get cinder_volume image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_cinder_volume_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container cinder_volume image\", \"set_fact\": {\"cinder_volume_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"cinder_volume_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-volume:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_cinder_volume_image\": \"{{xmllint_pcmk_cinder_volume_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"cinder_volume\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"cinder-volume temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"cinder_volume\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"openstack-cinder-volume\", \"tripleo_ha_image_update_new_image\": \"{{cinder_volume_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_cinder_volume_image}}\"}, \"when\": [\"(pcmk_cinder_volume_image != \\\"\\\")\", \"(pcmk_cinder_volume_image != cinder_volume_image_latest)\"]}]}], \"update_tasks\": [{\"block\": [{\"name\": \"Get cinder_volume image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_cinder_volume_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container cinder_volume image\", \"set_fact\": {\"cinder_volume_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"cinder_volume_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-volume:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_cinder_volume_image\": \"{{xmllint_pcmk_cinder_volume_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of cinder-volume container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_cinder_volume_image == cinder_volume_image_latest\", \"fail_msg\": \"cinder-volume image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"Tear-down non-HA cinder_volume container\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Remove non-HA cinder_volume container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"cinder_volume\"]}}]}, {\"name\": \"cinder_volume fetch and retag container image for pacemaker\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Retag pcmklatest to latest cinder_volume image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{cinder_volume_image}}\", \"container_image_latest\": \"{{cinder_volume_image_latest}}\"}}]}], \"post_update_tasks\": [{\"name\": \"Cinder volume bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Cinder volume puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"cinder_volume\", \"tripleo_ha_wrapper_resource_name\": \"openstack-cinder-volume\", \"tripleo_ha_wrapper_bundle_name\": \"openstack-cinder-volume\", \"tripleo_ha_wrapper_resource_state\": \"_ Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"cinder\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::volume_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".cinder_volume_previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}], \"upgrade_tasks\": {\"list_concat\": [[{\"name\": \"Tear-down non-HA cinder_volume container\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Remove non-HA cinder_volume container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"cinder_volume\"]}}]}, {\"name\": \"Prepare switch of cinder_volume image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get cinder_volume image id currently used by pacemaker\", \"shell\": \"pcs resource config openstack-cinder-volume | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"cinder_volume_image_current_res\", \"failed_when\": false}, {\"name\": \"cinder_volume image facts\", \"set_fact\": {\"cinder_volume_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-volume:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"cinder_volume_image_current\": \"{{cinder_volume_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current cinder_volume image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{cinder_volume_image_current}}\", \"container_image_latest\": \"{{cinder_volume_image_latest}}\", \"pull_image\": false}, \"when\": [\"cinder_volume_image_current != ''\", \"cinder_volume_image_current != cinder_volume_image_latest\"]}, {\"name\": \"Create cinder_volume retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/cinder_volume_needs_retag\", \"state\": \"touch\"}, \"when\": [\"cinder_volume_image_current != ''\", \"cinder_volume_image_current != cinder_volume_image_latest\"]}]}, {\"name\": \"Update cinder_volume pcs resource bundle for new container image\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"set is_cinder_volume_bootstrap_node fact\", \"tags\": \"common\", \"set_fact\": \"is_cinder_volume_bootstrap_node={{cinder_volume_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}, {\"name\": \"Check for cinder_volume retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/cinder_volume_needs_retag\"}, \"register\": \"cinder_volume_retag_state_file\"}]}, {\"name\": \"Update cinder_volume pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_cinder_volume_bootstrap_node\", \"cinder_volume_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the cinder_volume cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-volume\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"pcs resource bundle update cinder_volume for new container image name\", \"command\": \"pcs resource bundle update openstack-cinder-volume container image={{cinder_volume_image_latest}}\"}, {\"name\": \"Enable the cinder_volume cluster resource\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-volume\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}, {\"name\": \"Check for cinder_volume retag statefile\", \"when\": [\"step|int == 3\"], \"stat\": {\"path\": \"/var/lib/tripleo/cinder_volume_needs_retag\"}, \"register\": \"cinder_volume_retag_state_file\"}, {\"name\": \"Retag pacemaker cinder_volume\", \"when\": [\"step|int == 3\", \"cinder_volume_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the cinder_volume cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-volume\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Retag the pacemaker image if containerized\", \"block\": [{\"block\": [{\"name\": \"Get cinder_volume image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_cinder_volume_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-cinder-volume']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container cinder_volume image\", \"set_fact\": {\"cinder_volume_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"cinder_volume_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-volume:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderVolumeImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_cinder_volume_image\": \"{{xmllint_pcmk_cinder_volume_image.stdout}}\"}}]}, {\"block\": [{\"name\": \"Retag pcmklatest to latest cinder_volume image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{cinder_volume_image}}\", \"container_image_latest\": \"{{cinder_volume_image_latest}}\"}}]}]}, {\"name\": \"Enable the cinder_volume cluster resource\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-volume\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Remove cinder_volume retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/cinder_volume_needs_retag\", \"state\": \"absent\"}}]}], {\"get_attr\": [\"CinderCommon\", \"cinder_volume_upgrade_tasks\"]}]}, \"post_upgrade_tasks\": [{\"name\": \"Start cinder_volume service (pacemaker)\", \"become\": true, \"when\": \"step|int == 1\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-volume\", \"state\": \"enable\"}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/keystone/keystone-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Keystone service\\n\", \"parameters\": {\"ContainerKeystoneImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerKeystoneConfigImage\": {\"description\": \"The container image to use for the keystone config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"AdminPassword\": {\"description\": \"The password for the keystone admin account, used for monitoring, querying neutron etc.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneTokenProvider\": {\"description\": \"The keystone token format\", \"type\": \"string\", \"default\": \"fernet\", \"constraints\": [{\"allowed_values\": [\"fernet\"]}]}, \"SSLCertificate\": {\"default\": \"\", \"description\": \"The content of the SSL certificate (without Key) in PEM format.\\n\", \"type\": \"string\"}, \"PublicSSLCertificateAutogenerated\": {\"default\": false, \"description\": \"Whether the public SSL certificate was autogenerated or not.\\n\", \"type\": \"boolean\"}, \"EnablePublicTLS\": {\"default\": true, \"description\": \"Whether to enable TLS on the public interface or not.\\n\", \"type\": \"boolean\"}, \"PublicTLSCAFile\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the public network.\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}, \"KeystoneSSLCertificate\": {\"default\": \"\", \"description\": \"Keystone certificate for verifying token validity.\", \"type\": \"string\"}, \"KeystoneSSLCertificateKey\": {\"default\": \"\", \"description\": \"Keystone key for signing tokens.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneNotificationFormat\": {\"description\": \"The Keystone notification format\", \"default\": \"basic\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"basic\", \"cadf\"]}]}, \"KeystoneNotificationTopics\": {\"description\": \"Keystone notification topics to enable\", \"default\": [], \"type\": \"comma_delimited_list\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"KeystoneDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Keystone service.\", \"type\": \"boolean\"}, \"EnableCache\": {\"description\": \"Enable caching with memcached\", \"type\": \"boolean\", \"default\": true}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"AdminToken\": {\"description\": \"The keystone auth secret and db password.\", \"type\": \"string\", \"hidden\": true}, \"TokenExpiration\": {\"default\": 3600, \"description\": \"Set a token expiration time in seconds.\", \"type\": \"number\"}, \"KeystoneWorkers\": {\"type\": \"string\", \"description\": \"Set the number of workers for keystone::wsgi::apache\", \"default\": \"%{::os_workers_keystone}\"}, \"MonitoringSubscriptionKeystone\": {\"default\": \"overcloud-keystone\", \"type\": \"string\"}, \"KeystoneCredential0\": {\"type\": \"string\", \"description\": \"The first Keystone credential key. Must be a valid key.\"}, \"KeystoneCredential1\": {\"type\": \"string\", \"description\": \"The second Keystone credential key. Must be a valid key.\"}, \"KeystoneFernetKeys\": {\"type\": \"json\", \"description\": \"Mapping containing keystone's fernet keys and their paths.\"}, \"KeystoneFernetMaxActiveKeys\": {\"type\": \"number\", \"description\": \"The maximum active keys in the keystone fernet key repository.\", \"default\": 5}, \"ManageKeystoneFernetKeys\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Whether TripleO should manage the keystone fernet keys or not. If set to true, the fernet keys will get the values from the saved keys repository in mistral (the KeystoneFernetKeys variable). If set to false, only the stack creation initializes the keys, but subsequent updates won't touch them.\"}, \"KeystoneLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.keystone\", \"file\": \"/var/log/containers/keystone/keystone.log\"}}, \"KeystonePolicies\": {\"description\": \"A hash of policies to configure for Keystone.\\ne.g. { keystone-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"KeystoneLDAPDomainEnable\": {\"description\": \"Trigger to call ldap_backend puppet keystone define.\", \"type\": \"boolean\", \"default\": false}, \"KeystoneLDAPBackendConfigs\": {\"description\": \"Hash containing the configurations for the LDAP backends configured in keystone.\", \"type\": \"json\", \"default\": {}, \"hidden\": true}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"KeystoneNotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"Driver or drivers to handle sending notifications. This parameter is\\nspecific to Keystone.\\n\"}, \"KeystoneEnableDBPurge\": {\"default\": true, \"description\": \"Whether to create cron job for purging soft deleted rows in Keystone database.\\n\", \"type\": \"boolean\"}, \"KeystoneCronTrustFlushEnsure\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Ensure\\n\", \"default\": \"present\"}, \"KeystoneCronTrustFlushMinute\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Minute\\n\", \"default\": \"1\"}, \"KeystoneCronTrustFlushHour\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Hour\\n\", \"default\": \"*\"}, \"KeystoneCronTrustFlushMonthday\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Month Day\\n\", \"default\": \"*\"}, \"KeystoneCronTrustFlushMonth\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Month\\n\", \"default\": \"*\"}, \"KeystoneCronTrustFlushWeekday\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Week Day\\n\", \"default\": \"*\"}, \"KeystoneCronTrustFlushMaxDelay\": {\"type\": \"number\", \"description\": \"Cron to purge expired or soft-deleted trusts - Max Delay\\n\", \"default\": 0}, \"KeystoneCronTrustFlushDestination\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - Log destination\\n\", \"default\": \"/var/log/keystone/keystone-trustflush.log\"}, \"KeystoneCronTrustFlushUser\": {\"type\": \"string\", \"description\": \"Cron to purge expired or soft-deleted trusts - User\\n\", \"default\": \"keystone\"}, \"KeystoneChangePasswordUponFirstUse\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Enabling this option requires users to change their password when the user is created, or upon administrative reset.\", \"constraints\": [{\"allowed_values\": [\"\", \"true\", \"True\", \"TRUE\", \"false\", \"False\", \"FALSE\"]}]}, \"KeystoneDisableUserAccountDaysInactive\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The maximum number of days a user can go without authenticating before being considered \\\"inactive\\\" and automatically disabled (locked).\"}, \"KeystoneLockoutDuration\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The number of seconds a user account will be locked when the maximum number of failed authentication attempts (as specified by KeystoneLockoutFailureAttempts) is exceeded.\"}, \"KeystoneLockoutFailureAttempts\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The maximum number of times that a user can fail to authenticate before the user account is locked for the number of seconds specified by KeystoneLockoutDuration.\"}, \"KeystoneMinimumPasswordAge\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The number of days that a password must be used before the user can change it. This prevents users from changing their passwords immediately in order to wipe out their password history and reuse an old password.\"}, \"KeystonePasswordExpiresDays\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The number of days for which a password will be considered valid before requiring it to be changed.\"}, \"KeystonePasswordRegex\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The regular expression used to validate password strength requirements.\"}, \"KeystonePasswordRegexDescription\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Describe your password regular expression here in language for humans.\"}, \"KeystoneUniqueLastPasswordCount\": {\"type\": \"string\", \"default\": \"\", \"description\": \"This controls the number of previous user password iterations to keep in history, in order to enforce that newly created passwords are unique.\"}, \"KeystoneCorsAllowedOrigin\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Indicate whether this resource may be shared with the domain received in the request \\\"origin\\\" header.\"}, \"KeystoneEnableMember\": {\"description\": \"Create the _member_ role, useful for undercloud deployment.\", \"type\": \"boolean\", \"default\": false}, \"KeystoneFederationEnable\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Enable support for federated authentication.\"}, \"KeystoneTrustedDashboards\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"A list of dashboard URLs trusted for single sign-on.\"}, \"KeystoneAuthMethods\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"A list of methods used for authentication.\"}, \"KeystoneOpenIdcEnable\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Enable support for OpenIDC federation.\"}, \"KeystoneOpenIdcIdpName\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The name associated with the IdP in Keystone.\"}, \"KeystoneOpenIdcProviderMetadataUrl\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The url that points to your OpenID Connect provider metadata\"}, \"KeystoneOpenIdcClientId\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The client ID to use when handshaking with your OpenID Connect provider\"}, \"KeystoneOpenIdcClientSecret\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The client secret to use when handshaking with your OpenID Connect provider\"}, \"KeystoneOpenIdcCryptoPassphrase\": {\"type\": \"string\", \"default\": \"openstack\", \"description\": \"Passphrase to use when encrypting data for OpenID Connect handshake.\"}, \"KeystoneOpenIdcOutgoingProxy\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The outgoing proxy to use for OpenID connections.\"}, \"KeystoneOpenIdcResponseType\": {\"type\": \"string\", \"default\": \"id_token\", \"description\": \"Response type to be expected from the OpenID Connect provider.\"}, \"KeystoneOpenIdcRemoteIdAttribute\": {\"type\": \"string\", \"default\": \"OIDC-iss\", \"description\": \"Attribute to be used to obtain the entity ID of the Identity Provider from the environment.\"}, \"KeystoneOpenIdcEnableOAuth\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Enable OAuth 2.0 integration.\"}, \"KeystoneOpenIdcIntrospectionEndpoint\": {\"type\": \"string\", \"default\": \"\", \"description\": \"OAuth 2.0 introspection endpoint for mod_auth_openidc\"}, \"KeystoneOpenIdcClaimDelimiter\": {\"type\": \"string\", \"default\": \";\", \"description\": \"The delimiter to use when setting multi-valued claims.\"}, \"KeystoneOpenIdcPassUserInfoAs\": {\"type\": \"string\", \"default\": \"claims\", \"description\": \"Define the way(s) in which the claims resolved from the userinfo endpoint are passed to the application according to OIDCPassClaimsAs.\", \"constraints\": [{\"allowed_values\": [\"claims\", \"json\", \"jwt\"]}]}, \"KeystoneOpenIdcPassClaimsAs\": {\"type\": \"string\", \"default\": \"both\", \"description\": \"Define the way in which the claims and tokens are passed to the application environment: \\\"none\\\": no claims/tokens are passed \\\"environment\\\": claims/tokens are passed as environment variables \\\"headers\\\": claims/tokens are passed in headers (also useful in reverse proxy scenario's) \\\"both\\\": claims/tokens are passed as both headers as well as environment variables (default)\", \"constraints\": [{\"allowed_values\": [\"none\", \"environment\", \"headers\", \"both\"]}]}, \"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"KeystoneLogging\": {\"type\": \"OS::TripleO::Services::Logging::Keystone\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerKeystoneImage\": \"ContainerKeystoneImage\", \"ContainerKeystoneConfigImage\": \"ContainerKeystoneConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerKeystoneImage\": {\"get_param\": \"ContainerKeystoneImage\"}, \"ContainerKeystoneConfigImage\": {\"get_param\": \"ContainerKeystoneConfigImage\"}}}]}}}}, \"conditions\": {\"public_tls_enabled\": {\"and\": [{\"get_param\": \"EnablePublicTLS\"}, {\"or\": [{\"not\": {\"equals\": [{\"get_param\": \"SSLCertificate\"}, \"\"]}}, {\"get_param\": \"PublicSSLCertificateAutogenerated\"}]}]}, \"keystone_fernet_tokens\": {\"equals\": [{\"get_param\": \"KeystoneTokenProvider\"}, \"fernet\"]}, \"nontls_cache_enabled\": {\"and\": [{\"get_param\": \"EnableCache\"}, {\"not\": {\"get_param\": \"MemcachedTLS\"}}]}, \"tls_cache_enabled\": {\"and\": [{\"get_param\": \"EnableCache\"}, {\"get_param\": \"MemcachedTLS\"}]}, \"keystone_outgoing_proxy\": {\"and\": [{\"not\": {\"equals\": [{\"get_param\": \"KeystoneOpenIdcOutgoingProxy\"}, \"\"]}}, {\"get_param\": \"KeystoneOpenIdcEnable\"}]}, \"change_password_upon_first_use_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneChangePasswordUponFirstUse\"}, \"\"]}}, \"disable_user_account_days_inactive_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneDisableUserAccountDaysInactive\"}, \"\"]}}, \"lockout_duration_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneLockoutDuration\"}, \"\"]}}, \"lockout_failure_attempts_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneLockoutFailureAttempts\"}, \"\"]}}, \"minimum_password_age_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneMinimumPasswordAge\"}, \"\"]}}, \"password_expires_days_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystonePasswordExpiresDays\"}, \"\"]}}, \"password_regex_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystonePasswordRegex\"}, \"\"]}}, \"password_regex_description_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystonePasswordRegexDescription\"}, \"\"]}}, \"unique_last_password_count_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneUniqueLastPasswordCount\"}, \"\"]}}, \"cors_allowed_origin_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneCorsAllowedOrigin\"}, \"\"]}}, \"keystone_notification_driver_set\": {\"not\": {\"equals\": [{\"get_param\": \"KeystoneNotificationDriver\"}, []]}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Keystone API role.\", \"value\": {\"service_name\": \"keystone\", \"firewall_rules\": {\"111 keystone\": {\"dport\": [5000, {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}]}}, \"firewall_frontend_rules\": {\"100 keystone_public_haproxy_frontend\": {\"dport\": [5000]}, \"100 keystone_admin_haproxy_frontend\": {\"dport\": [{\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}]}}, \"firewall_ssl_frontend_rules\": {\"100 keystone_public_haproxy_frontend_ssl\": {\"dport\": [13000]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionKeystone\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"if\": [\"cors_allowed_origin_set\", {\"keystone::cors::allowed_origin\": {\"get_param\": \"KeystoneCorsAllowedOrigin\"}}]}, {\"keystone::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"keystone\", \"password\": {\"get_param\": \"AdminToken\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/keystone\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"keystone\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"keystone::token_expiration\": {\"get_param\": \"TokenExpiration\"}, \"keystone::policy::policies\": {\"get_param\": \"KeystonePolicies\"}, \"keystone_ssl_certificate\": {\"get_param\": \"KeystoneSSLCertificate\"}, \"keystone_ssl_certificate_key\": {\"get_param\": \"KeystoneSSLCertificateKey\"}, \"keystone::token_provider\": {\"get_param\": \"KeystoneTokenProvider\"}, \"keystone::enable_fernet_setup\": {\"if\": [\"keystone_fernet_tokens\", true, false]}, \"keystone::fernet_max_active_keys\": {\"get_param\": \"KeystoneFernetMaxActiveKeys\"}, \"keystone::enable_proxy_headers_parsing\": true, \"keystone::enable_credential_setup\": true, \"keystone::credential_keys\": {\"/etc/keystone/credential-keys/0\": {\"content\": {\"get_param\": \"KeystoneCredential0\"}}, \"/etc/keystone/credential-keys/1\": {\"content\": {\"get_param\": \"KeystoneCredential1\"}}}, \"keystone::fernet_keys\": {\"get_param\": \"KeystoneFernetKeys\"}, \"keystone::fernet_replace_keys\": {\"get_param\": \"ManageKeystoneFernetKeys\"}, \"keystone::logging::debug\": {\"if\": [{\"get_param\": \"KeystoneDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"keystone::notification_driver\": {\"if\": [\"keystone_notification_driver_set\", {\"get_param\": \"KeystoneNotificationDriver\"}, {\"get_param\": \"NotificationDriver\"}]}, \"keystone::notification_format\": {\"get_param\": \"KeystoneNotificationFormat\"}, \"tripleo::profile::base::keystone::extra_notification_topics\": {\"get_param\": \"KeystoneNotificationTopics\"}, \"keystone_enable_db_purge\": {\"get_param\": \"KeystoneEnableDBPurge\"}, \"keystone::cron::trust_flush::ensure\": {\"get_param\": \"KeystoneCronTrustFlushEnsure\"}, \"keystone::cron::trust_flush::minute\": {\"get_param\": \"KeystoneCronTrustFlushMinute\"}, \"keystone::cron::trust_flush::hour\": {\"get_param\": \"KeystoneCronTrustFlushHour\"}, \"keystone::cron::trust_flush::monthday\": {\"get_param\": \"KeystoneCronTrustFlushMonthday\"}, \"keystone::cron::trust_flush::month\": {\"get_param\": \"KeystoneCronTrustFlushMonth\"}, \"keystone::cron::trust_flush::weekday\": {\"get_param\": \"KeystoneCronTrustFlushWeekday\"}, \"keystone::cron::trust_flush::maxdelay\": {\"get_param\": \"KeystoneCronTrustFlushMaxDelay\"}, \"keystone::cron::trust_flush::destination\": {\"get_param\": \"KeystoneCronTrustFlushDestination\"}, \"keystone::cron::trust_flush::user\": {\"get_param\": \"KeystoneCronTrustFlushUser\"}, \"keystone::rabbit_heartbeat_timeout_threshold\": 60, \"keystone::rabbit_heartbeat_in_pthread\": false, \"keystone::service_name\": \"httpd\", \"keystone::enable_ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"keystone::wsgi::apache::api_port\": [5000, {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"port\"]}], \"keystone::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"keystone::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}}}, \"keystone::wsgi::apache::workers\": {\"get_param\": \"KeystoneWorkers\"}, \"keystone::wsgi::apache::threads\": 1, \"keystone::db::database_db_max_retries\": -1, \"keystone::db::database_max_retries\": -1, \"keystone::wsgi::apache::bind_host\": [{\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystonePublicApiNetwork\"]}}}}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"KeystoneAdminApiNetwork\"]}}}}]}, {\"keystone::cache::enabled\": {\"get_param\": \"EnableCache\"}, \"keystone::cache::backend_argument\": [{\"str_replace\": {\"template\": \"memcached_expire_time: $EXPIRATION\", \"params\": {\"$EXPIRATION\": {\"get_param\": \"TokenExpiration\"}}}}], \"keystone::cache::tls_enabled\": {\"get_param\": \"MemcachedTLS\"}}, {\"if\": [\"tls_cache_enabled\", {\"keystone::cache::backend\": \"dogpile.cache.pymemcache\", \"keystone::token_caching\": true}, {\"keystone::cache::backend\": \"dogpile.cache.memcached\"}]}, {\"if\": [{\"get_param\": \"KeystoneFederationEnable\"}, {\"keystone_federation_enabled\": true, \"keystone::federation::trusted_dashboards\": {\"get_param\": \"KeystoneTrustedDashboards\"}}]}, {\"if\": [{\"get_param\": \"KeystoneOpenIdcEnable\"}, {\"keystone_openidc_enabled\": true, \"keystone::federation::openidc::methods\": {\"get_param\": \"KeystoneAuthMethods\"}, \"keystone::federation::openidc::keystone_url\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"keystone::federation::openidc::idp_name\": {\"get_param\": \"KeystoneOpenIdcIdpName\"}, \"keystone::federation::openidc::openidc_provider_metadata_url\": {\"get_param\": \"KeystoneOpenIdcProviderMetadataUrl\"}, \"keystone::federation::openidc::openidc_client_id\": {\"get_param\": \"KeystoneOpenIdcClientId\"}, \"keystone::federation::openidc::openidc_client_secret\": {\"get_param\": \"KeystoneOpenIdcClientSecret\"}, \"keystone::federation::openidc::openidc_crypto_passphrase\": {\"get_param\": \"KeystoneOpenIdcCryptoPassphrase\"}, \"keystone::federation::openidc::openidc_response_type\": {\"get_param\": \"KeystoneOpenIdcResponseType\"}, \"keystone::federation::openidc::remote_id_attribute\": {\"get_param\": \"KeystoneOpenIdcRemoteIdAttribute\"}, \"keystone::federation::openidc::openidc_enable_oauth\": {\"get_param\": \"KeystoneOpenIdcEnableOAuth\"}, \"keystone::federation::openidc::openidc_introspection_endpoint\": {\"get_param\": \"KeystoneOpenIdcIntrospectionEndpoint\"}, \"keystone::federation::openidc::openidc_pass_userinfo_as\": {\"get_param\": \"KeystoneOpenIdcPassUserInfoAs\"}, \"keystone::federation::openidc::openidc_pass_claim_as\": {\"get_param\": \"KeystoneOpenIdcPassClaimsAs\"}, \"keystone::federation::openidc::openidc_claim_delimiter\": {\"get_param\": \"KeystoneOpenIdcClaimDelimiter\"}, \"keystone::federation::openidc::openidc_cache_type\": {\"if\": [\"nontls_cache_enabled\", \"memcache\"]}}]}, {\"if\": [\"keystone_outgoing_proxy\", {\"keystone::federation::openidc::openidc_outgoing_proxy\": {\"get_param\": \"KeystoneOpenIdcOutgoingProxy\"}}]}, {\"if\": [{\"get_param\": \"KeystoneLDAPDomainEnable\"}, {\"tripleo::profile::base::keystone::ldap_backend_enable\": true, \"keystone::using_domain_config\": true, \"tripleo::profile::base::keystone::ldap_backends_config\": {\"get_param\": \"KeystoneLDAPBackendConfigs\"}}]}, {\"if\": [\"change_password_upon_first_use_set\", {\"keystone::security_compliance::change_password_upon_first_use\": {\"get_param\": \"KeystoneChangePasswordUponFirstUse\"}}]}, {\"if\": [\"disable_user_account_days_inactive_set\", {\"keystone::security_compliance::disable_user_account_days_inactive\": {\"get_param\": \"KeystoneDisableUserAccountDaysInactive\"}}]}, {\"if\": [\"lockout_duration_set\", {\"keystone::security_compliance::lockout_duration\": {\"get_param\": \"KeystoneLockoutDuration\"}}]}, {\"if\": [\"lockout_failure_attempts_set\", {\"keystone::security_compliance::lockout_failure_attempts\": {\"get_param\": \"KeystoneLockoutFailureAttempts\"}}]}, {\"if\": [\"minimum_password_age_set\", {\"keystone::security_compliance::minimum_password_age\": {\"get_param\": \"KeystoneMinimumPasswordAge\"}}]}, {\"if\": [\"password_expires_days_set\", {\"keystone::security_compliance::password_expires_days\": {\"get_param\": \"KeystonePasswordExpiresDays\"}}]}, {\"if\": [\"password_regex_set\", {\"keystone::security_compliance::password_regex\": {\"get_param\": \"KeystonePasswordRegex\"}}]}, {\"if\": [\"password_regex_description_set\", {\"keystone::security_compliance::password_regex_description\": {\"get_param\": \"KeystonePasswordRegexDescription\"}}]}, {\"if\": [\"unique_last_password_count_set\", {\"keystone::security_compliance::unique_last_password_count\": {\"get_param\": \"KeystoneUniqueLastPasswordCount\"}}]}, {\"apache::default_vhost\": false}, {\"get_attr\": [\"KeystoneLogging\", \"config_settings\"]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_keystone\": {\"get_param\": \"KeystoneLoggingSource\"}}, \"mysql\": {\"keystone::db::mysql::password\": {\"get_param\": \"AdminToken\"}, \"keystone::db::mysql::user\": \"keystone\", \"keystone::db::mysql::host\": \"%\", \"keystone::db::mysql::dbname\": \"keystone\"}, \"pacemaker\": {\"keystone::endpoint::public_url\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"keystone::endpoint::internal_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"keystone::endpoint::admin_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"uri_no_suffix\"]}, \"keystone::endpoint::region\": {\"get_param\": \"KeystoneRegion\"}, \"keystone::admin_password\": {\"get_param\": \"AdminPassword\"}}, \"horizon\": {\"if\": [{\"get_param\": \"KeystoneLDAPDomainEnable\"}, {\"horizon::keystone_multidomain_support\": true, \"horizon::keystone_default_domain\": \"Default\"}]}}, \"puppet_config\": {\"config_volume\": \"keystone\", \"puppet_tags\": \"keystone_config,keystone_domain_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"['Keystone_user', 'Keystone_endpoint', 'Keystone_domain', 'Keystone_tenant', 'Keystone_user_role', 'Keystone_role', 'Keystone_service'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::base::keystone\\n\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerKeystoneConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/keystone.json\": {\"command\": \"/usr/sbin/httpd\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/keystone/fernet-keys\", \"dest\": \"/etc/keystone/fernet-keys\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/keystone_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"KeystoneLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"keystone_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerKeystoneImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"KeystoneLogging\", \"volumes\"]}, [\"/etc/openldap:/etc/openldap:ro\", \"/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"map_merge\": [{\"get_attr\": [\"KeystoneLogging\", \"environment\"]}, {\"KOLLA_BOOTSTRAP\": true, \"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}]}, \"command\": [\"/usr/bin/bootstrap_host_exec\", \"keystone\", \"/usr/local/bin/kolla_start\"]}, \"keystone\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerKeystoneImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"KeystoneLogging\", \"volumes\"]}, [\"/etc/openldap:/etc/openldap:ro\", \"/var/lib/kolla/config_files/keystone.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"keystone_bootstrap\": {\"start_order\": 3, \"action\": \"exec\", \"user\": \"root\", \"command\": [\"keystone\", \"/usr/bin/bootstrap_host_exec\", \"keystone\", \"keystone-manage\", \"bootstrap\"], \"environment\": {\"KOLLA_BOOTSTRAP\": true, \"OS_BOOTSTRAP_PASSWORD\": {\"get_param\": \"AdminPassword\"}, \"OS_BOOTSTRAP_USERNAME\": \"admin\", \"OS_BOOTSTRAP_PROJECT_NAME\": \"admin\", \"OS_BOOTSTRAP_ROLE_NAME\": \"admin\", \"OS_BOOTSTRAP_SERVICE_NAME\": \"keystone\", \"OS_BOOTSTRAP_ADMIN_URL\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"uri_no_suffix\"]}, \"OS_BOOTSTRAP_PUBLIC_URL\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"OS_BOOTSTRAP_INTERNAL_URL\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"OS_BOOTSTRAP_REGION_ID\": {\"get_param\": \"KeystoneRegion\"}}}, \"keystone_cron\": {\"start_order\": 4, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerKeystoneImage\"]}, \"user\": \"root\", \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron keystone\"}, \"command\": [\"/bin/bash\", \"-c\", \"/usr/local/bin/kolla_set_configs && /usr/sbin/crond -n\"], \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"KeystoneLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/keystone_cron.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/keystone:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, \"step_4\": {\"keystone_refresh\": {\"start_order\": 1, \"action\": \"exec\", \"user\": \"root\", \"command\": [\"keystone\", \"pkill\", \"--signal\", \"USR1\", \"httpd\"]}}}, \"external_deploy_tasks\": [{\"name\": \"Manage clouds.yaml files\", \"when\": [\"step|int == 1\", \"not ansible_check_mode|bool\"], \"block\": [{\"name\": \"Create /etc/openstack directory if it does not exist\", \"become\": true, \"file\": {\"mode\": \"0755\", \"owner\": \"root\", \"path\": \"/etc/openstack\", \"state\": \"directory\"}}, {\"name\": \"Configure /etc/openstack/clouds.yaml\", \"include_role\": {\"name\": \"tripleo_keystone_resources\", \"tasks_from\": \"clouds\"}, \"vars\": {\"tripleo_keystone_resources_cloud_name\": {\"get_param\": \"RootStackName\"}, \"tripleo_keystone_resources_cloud_config\": {\"auth\": {\"auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"password\": {\"get_param\": \"AdminPassword\"}, \"project_domain_name\": \"Default\", \"project_name\": \"admin\", \"user_domain_name\": \"Default\", \"username\": \"admin\"}, \"cacert\": {\"if\": [\"public_tls_enabled\", {\"get_param\": \"PublicTLSCAFile\"}, \"\"]}, \"identity_api_version\": \"3\", \"volume_api_version\": \"3\", \"region_name\": {\"get_param\": \"KeystoneRegion\"}}}}]}, {\"name\": \"Manage Keystone resources\", \"become\": true, \"when\": [\"step|int == 4\", \"not ansible_check_mode|bool\"], \"block\": [{\"name\": \"Manage Keystone resources for OpenStack services\", \"include_role\": {\"name\": \"tripleo_keystone_resources\"}, \"vars\": {\"tripleo_keystone_resources_catalog_config\": \"{{ keystone_resources }}\", \"tripleo_keystone_resources_service_project\": \"service\", \"tripleo_keystone_resources_cloud_name\": {\"get_param\": \"RootStackName\"}, \"tripleo_keystone_resources_region\": {\"get_param\": \"KeystoneRegion\"}, \"tripleo_keystone_resources_admin_endpoint\": {\"get_param\": [\"EndpointMap\", \"KeystoneAdmin\", \"uri_no_suffix\"]}, \"tripleo_keystone_resources_public_endpoint\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"tripleo_keystone_resources_internal_endpoint\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"tripleo_keystone_resources_admin_password\": {\"get_param\": \"AdminPassword\"}, \"tripleo_keystone_resources_member_role_enabled\": {\"get_param\": \"KeystoneEnableMember\"}}}, {\"name\": \"is Keystone LDAP enabled\", \"set_fact\": {\"keystone_ldap_domain_enabled\": {\"get_param\": \"KeystoneLDAPDomainEnable\"}}}, {\"name\": \"Set fact for tripleo_keystone_ldap_domains\", \"set_fact\": {\"tripleo_keystone_ldap_domains\": {\"get_param\": \"KeystoneLDAPBackendConfigs\"}}, \"when\": \"keystone_ldap_domain_enabled|bool\"}, {\"name\": \"Manage Keystone domains from LDAP config\", \"when\": \"keystone_ldap_domain_enabled|bool\", \"include_role\": {\"name\": \"tripleo_keystone_resources\", \"tasks_from\": \"domains\"}, \"vars\": {\"tripleo_keystone_resources_catalog_config\": \"{{ keystone_resources }}\", \"tripleo_keystone_resources_cloud_name\": {\"get_param\": \"RootStackName\"}, \"batched_tripleo_keystone_resources_domains\": \"{{ tripleo_keystone_ldap_domains | list }}\"}}]}], \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, [{\"name\": \"validate keystone container state\", \"containers.podman.podman_container_info\": {\"name\": \"keystone\"}, \"register\": \"keystone_infos\", \"failed_when\": [\"keystone_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in keystone_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-keystone\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 4\"]}]]}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"KeystoneLogging\", \"host_prep_tasks\"]}, [{\"name\": \"Check if file certs_valid exist\", \"stat\": {\"path\": \"/etc/openldap/certs/certs_valid\"}, \"register\": \"certs_valid_stat\"}, {\"name\": \"Check if file cert9.db exist\", \"stat\": {\"path\": \"/etc/openldap/certs/cert9.db\"}, \"register\": \"cert9_stat\", \"when\": \"not certs_valid_stat.stat.exists\"}, {\"name\": \"Check if file key4.db exist\", \"stat\": {\"path\": \"/etc/openldap/certs/key4.db\"}, \"register\": \"key4_stat\", \"when\": \"not certs_valid_stat.stat.exists\"}, {\"fail\": {\"msg\": \"Keys and/or certificates were found in /etc/openldap/certs but these conflicts with keystone python LDAP calls.  If you know those certificates are valid and not causing any conflicts, you can touch /etc/openldap/certs/certs_valid in order to skip this failure and retry or you can delete the files located in /etc/openldap/certs and retry.\\n\"}, \"when\": \"( cert9_stat.stat.exists or key4_stat.stat.exists ) and not certs_valid_stat.stat.exists\"}]]}, \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop keystone container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"keystone\", \"keystone_cron\"], \"tripleo_delegate_to\": \"{{ groups['keystone'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/glance/glance-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Glance service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"GlanceDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Glance service.\", \"type\": \"boolean\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"GlancePassword\": {\"description\": \"The password for the glance service and db account, used by the glance services.\", \"type\": \"string\", \"hidden\": true}, \"GlanceWorkers\": {\"default\": \"\", \"description\": \"Number of API worker processes for Glance. If left unset (empty string), the\\ndefault value will result in the configuration being left unset and a\\nsystem-dependent default value will be chosen (e.g.: number of\\nprocessors). Please note that this will create a large number of\\nprocesses on systems with a large number of CPUs resulting in excess\\nmemory consumption. It is recommended that a suitable non-default value\\nbe selected on such systems.\\n\", \"type\": \"string\"}, \"MonitoringSubscriptionGlanceApi\": {\"default\": \"overcloud-glance-api\", \"type\": \"string\"}, \"GlanceApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.glance.api\", \"file\": \"/var/log/containers/glance/api.log\"}}, \"GlanceImageMemberQuota\": {\"default\": 128, \"description\": \"Maximum number of image members per image.\\nNegative values evaluate to unlimited.\\n\", \"type\": \"number\"}, \"GlanceNfsEnabled\": {\"default\": false, \"description\": \"When using GlanceBackend 'file', mount NFS share for image storage.\\n\", \"type\": \"boolean\"}, \"GlanceCacheEnabled\": {\"description\": \"Enable Glance Image Cache\", \"type\": \"boolean\", \"default\": false}, \"GlanceImageCacheDir\": {\"description\": \"Base directory that the Image Cache uses\", \"type\": \"string\", \"default\": \"/var/lib/glance/image-cache\"}, \"GlanceImageCacheMaxSize\": {\"description\": \"The upper limit on cache size, in bytes, after which the cache-pruner cleans up the image cache.\\n\", \"type\": \"number\", \"default\": 10737418240}, \"GlanceImageCacheStallTime\": {\"description\": \"The amount of time, in seconds, to let an image remain in the cache without being accessed.\\n\", \"type\": \"number\", \"default\": 86400}, \"GlanceImagePrefetcherInterval\": {\"description\": \"The interval in seconds to run periodic job cache_images.\\n\", \"type\": \"number\", \"default\": 300}, \"GlanceNfsShare\": {\"default\": \"\", \"description\": \"NFS share to mount for image storage (when GlanceNfsEnabled is true)\\n\", \"type\": \"string\"}, \"GlanceNetappNfsEnabled\": {\"default\": false, \"description\": \"When using GlanceBackend 'file', Netapp mount NFS share for image storage.\\n\", \"type\": \"boolean\"}, \"NetappShareLocation\": {\"default\": \"\", \"description\": \"Netapp share to mount for image storage (when GlanceNetappNfsEnabled is true)\\n\", \"type\": \"string\"}, \"GlanceNfsOptions\": {\"default\": \"_netdev,bg,intr,context=system_u:object_r:container_file_t:s0\", \"description\": \"NFS mount options for image storage (when GlanceNfsEnabled is true)\\n\", \"type\": \"string\"}, \"GlanceRbdPoolName\": {\"default\": \"images\", \"type\": \"string\"}, \"NovaEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable the Rbd backend for Nova ephemeral storage.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"GlanceImageImportPlugins\": {\"default\": [\"no_op\"], \"description\": \"List of enabled Image Import Plugins. Valid values in the list are 'image_conversion', 'inject_metadata', 'no_op'.\\n\", \"type\": \"comma_delimited_list\"}, \"GlanceDiskFormats\": {\"default\": \"\", \"description\": \"List of allowed disk formats in Glance; all formats are allowed when left unset.\\n\", \"type\": \"comma_delimited_list\"}, \"GlanceImageConversionOutputFormat\": {\"default\": \"raw\", \"description\": \"Desired output format for image conversion plugin.\", \"type\": \"string\"}, \"GlanceInjectMetadataProperties\": {\"default\": \"\", \"description\": \"Metadata properties to be injected in image.\", \"type\": \"comma_delimited_list\"}, \"GlanceIgnoreUserRoles\": {\"default\": \"admin\", \"description\": \"List of user roles to be ignored for injecting image metadata properties.\", \"type\": \"comma_delimited_list\"}, \"GlanceEnabledImportMethods\": {\"default\": \"web-download\", \"description\": \"List of enabled Image Import Methods. Valid values in the list are 'glance-direct', 'web-download', or 'copy-image'\\n\", \"type\": \"comma_delimited_list\"}, \"GlanceStagingNfsShare\": {\"default\": \"\", \"description\": \"NFS share to mount for image import staging\\n\", \"type\": \"string\"}, \"GlanceNodeStagingUri\": {\"default\": \"file:///var/lib/glance/staging\", \"description\": \"URI that specifies the staging location to use when importing images\\n\", \"type\": \"string\"}, \"GlanceStagingNfsOptions\": {\"default\": \"_netdev,bg,intr,context=system_u:object_r:container_file_t:s0\", \"description\": \"NFS mount options for NFS image import staging\\n\", \"type\": \"string\"}, \"GlanceSparseUploadEnabled\": {\"default\": false, \"description\": \"When using GlanceBackend 'file' and 'rbd' to enable or not sparse upload.\\n\", \"type\": \"boolean\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"GlanceApiPolicies\": {\"description\": \"A hash of policies to configure for Glance API.\\ne.g. { glance-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"GlanceNotifierStrategy\": {\"description\": \"Strategy to use for Glance notification queue\", \"type\": \"string\", \"default\": \"noop\"}, \"GlanceLogFile\": {\"description\": \"The filepath of the file to use for logging messages from Glance.\", \"type\": \"string\", \"default\": \"\"}, \"GlanceBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Glance backend to use. Should be one of swift, rbd, cinder, or file\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"file\", \"rbd\", \"cinder\"]}]}, \"GlanceBackendID\": {\"type\": \"string\", \"default\": \"default_backend\", \"description\": \"The default backend's identifier.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9_-]+\"}]}, \"GlanceStoreDescription\": {\"type\": \"string\", \"default\": \"Default glance store backend.\", \"description\": \"User facing description for the Glance backend.\"}, \"GlanceMultistoreConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring additional glance backends. The\\nhash key is the backend ID, and the value is a dictionary of parameter\\nvalues unique to that backend. Multiple rbd and cinder backends are allowed, but\\nfile and swift backends are limited to one each. Example:\\n  # Default glance store is rbd.\\n  GlanceBackend: rbd\\n  GlanceStoreDescription: 'Default rbd store'\\n  # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder\\n  # backend.\\n  GlanceMultistoreConfig:\\n    rbd2_store:\\n      GlanceBackend: rbd\\n      GlanceStoreDescription: 'Second rbd store'\\n      CephClusterName: ceph2\\n      # Override CephClientUserName if this cluster uses a different\\n      # client name.\\n      CephClientUserName: client2\\n    cinder1_store:\\n      GlanceBackend: cinder\\n      GlanceCinderVolumeType: 'volume-type-1'\\n      GlanceStoreDescription: 'First cinder store'\\n    cinder2_store:\\n      GlanceBackend: cinder\\n      GlanceCinderVolumeType: 'volume-type-2'\\n      GlanceStoreDescription: 'Seconde cinder store'\\n\"}, \"GlanceCinderMountPointBase\": {\"default\": \"/var/lib/glance/mnt\", \"type\": \"string\", \"description\": \"The mount point base when glance is using cinder as store and cinder backend\\nis NFS. This mount point is where the NFS volume is mounted on the glance node.\\n\"}, \"GlanceCinderVolumeType\": {\"default\": \"\", \"type\": \"string\", \"description\": \"A unique volume type required for each cinder store while configuring multiple cinder\\nstores as glance backends. The same volume types must be configured in Cinder as well.\\nThe volume type must exist in cinder prior to any attempt to add an image in the associated\\ncinder store. If no volume type is specified then cinder's default volume type will be used.\\n\"}, \"GlanceCinderLockPath\": {\"default\": \"/var/lib/cinder/tmp\", \"type\": \"string\", \"description\": \"The oslo.coordination lock_path to use when glance is using cinder as a store. Using\\ncinder's lock_path ensures os-brick operations are synchronized across both services.\\n\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"MultipathdEnable\": {\"default\": false, \"description\": \"Whether to enable the multipath daemon\", \"type\": \"boolean\"}, \"GlanceApiOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\"}, \"ContainerGlanceApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerGlanceApiConfigImage\": {\"description\": \"The container image to use for the glance_api config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"GlanceCronDbPurgeMinute\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Minute\\n\", \"default\": \"1\"}, \"GlanceCronDbPurgeHour\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Hour\\n\", \"default\": \"0\"}, \"GlanceCronDbPurgeMonthday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month Day\\n\", \"default\": \"*\"}, \"GlanceCronDbPurgeMonth\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month\\n\", \"default\": \"*\"}, \"GlanceCronDbPurgeWeekday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Week Day\\n\", \"default\": \"*\"}, \"GlanceCronDbPurgeUser\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - User\\n\", \"default\": \"glance\"}, \"GlanceCronDbPurgeAge\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Age\\n\", \"default\": \"30\"}, \"GlanceCronDbPurgeMaxRows\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Max Rows\\n\", \"default\": \"100\"}, \"GlanceCronDbPurgeDestination\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Log destination\\n\", \"default\": \"/var/log/glance/glance-rowsflush.log\"}, \"GlanceCronDbPurgeMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Max Delay\\n\", \"default\": \"3600\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"GlanceShowMultipleLocations\": {\"default\": false, \"description\": \"Whether to show multiple image locations e.g for copy-on-write support on\\nRBD or Netapp backends. Potential security risk, see glance.conf for more information.\\n\", \"type\": \"boolean\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments.\\n\", \"parameters\": [\"GlanceShowMultipleLocations\"]}], \"conditions\": {\"cinder_backend_enabled\": {\"or\": [{\"equals\": [{\"get_param\": \"GlanceBackend\"}, \"cinder\"]}, {\"yaql\": {\"expression\": \"$.data.values().any($.get(\\\"GlanceBackend\\\", \\\"\\\") = \\\"cinder\\\")\", \"data\": {\"get_param\": \"GlanceMultistoreConfig\"}}}]}, \"cinder_multipathd_enabled\": {\"and\": [\"cinder_backend_enabled\", {\"get_param\": \"MultipathdEnable\"}]}, \"rbd_backend_enabled\": {\"or\": [{\"equals\": [{\"get_param\": \"GlanceBackend\"}, \"rbd\"]}, {\"yaql\": {\"expression\": \"$.data.values().any($.get(\\\"GlanceBackend\\\", \\\"\\\") = \\\"rbd\\\")\", \"data\": {\"get_param\": \"GlanceMultistoreConfig\"}}}]}, \"force_image_conversion_plugin\": {\"or\": [{\"and\": [\"rbd_backend_enabled\", {\"equals\": [{\"get_param\": \"GlanceImageImportPlugins\"}, [\"no_op\"]]}, {\"get_param\": \"NovaEnableRbdBackend\"}]}, {\"get_param\": \"GlanceSparseUploadEnabled\"}]}, \"glance_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"GlanceWorkers\"}, \"\"]}}, \"glance_multiple_locations\": {\"or\": [{\"get_param\": \"GlanceShowMultipleLocations\"}, {\"get_param\": \"GlanceNetappNfsEnabled\"}, {\"and\": [\"rbd_backend_enabled\", {\"get_param\": \"NovaEnableRbdBackend\"}]}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"GlanceLogging\": {\"type\": \"OS::TripleO::Services::Logging::GlanceApi\"}, \"CinderNVMeOF\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backend-nvmeof-puppet.yaml\"}, \"TLSProxyBase\": {\"type\": \"OS::TripleO::Services::TLSProxyBase\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerGlanceApiImage\": \"ContainerGlanceApiImage\", \"ContainerGlanceApiConfigImage\": \"ContainerGlanceApiConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerGlanceApiImage\": {\"get_param\": \"ContainerGlanceApiImage\"}, \"ContainerGlanceApiConfigImage\": {\"get_param\": \"ContainerGlanceApiConfigImage\"}}}]}}}}, \"outputs\": {\"glance_api_host_prep_and_system_upgrade_post_tasks\": {\"description\": \"Common host_prep and system_upgrade post tasks for glance_api\", \"value\": [{\"name\": \"Mount NFS on host\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GlanceNfsEnabled\"}, \"glance_netapp_nfs_enabled\": {\"get_param\": \"GlanceNetappNfsEnabled\"}, \"glance_nfs_share\": {\"get_param\": \"GlanceNfsShare\"}, \"netapp_share_location\": {\"get_param\": \"NetappShareLocation\"}, \"nfs_share\": \"{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}\", \"nfs_options\": {\"get_param\": \"GlanceNfsOptions\"}}, \"mount\": {\"name\": \"/var/lib/glance/images\", \"state\": \"mounted\", \"fstype\": \"nfs\", \"src\": \"{{nfs_share}}\", \"opts\": \"{{nfs_options}}\"}, \"when\": \"nfs_backend_enabled or glance_netapp_nfs_enabled\"}, {\"name\": \"Mount Node Staging Location\", \"vars\": {\"glance_node_staging_uri\": {\"get_param\": \"GlanceNodeStagingUri\"}, \"glance_staging_nfs_share\": {\"get_param\": \"GlanceStagingNfsShare\"}, \"glance_nfs_options\": {\"get_param\": \"GlanceStagingNfsOptions\"}}, \"mount\": {\"name\": \"{{glance_node_staging_uri[7:]}}\", \"state\": \"mounted\", \"fstype\": \"nfs\", \"src\": \"{{glance_staging_nfs_share}}\", \"opts\": \"{{glance_nfs_options}}\"}, \"when\": \"glance_staging_nfs_share != ''\"}]}, \"role_data\": {\"description\": \"Role data for the Glance API role.\", \"value\": {\"service_name\": \"glance_api\", \"firewall_rules\": {\"112 glance_api\": {\"dport\": [9292]}}, \"firewall_frontend_rules\": {\"100 glance_api_haproxy_frontend\": {\"dport\": [9292]}}, \"firewall_ssl_frontend_rules\": {\"100 glance_api_haproxy_frontend_ssl\": {\"dport\": [13292]}}, \"keystone_resources\": {\"glance\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"GlancePublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"GlanceAdmin\", \"uri\"]}}, \"users\": {\"glance\": {\"password\": {\"get_param\": \"GlancePassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"image\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionGlanceApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"config_settings\"]}, {\"glance::api::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"glance\", \"password\": {\"get_param\": \"GlancePassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/glance\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"glance\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"glance::api::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"glance::api::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"glance::api::enable_v1_api\": false, \"glance::api::enable_v2_api\": true, \"glance::api::authtoken::password\": {\"get_param\": \"GlancePassword\"}, \"glance::api::enable_proxy_headers_parsing\": true, \"glance::api::logging::debug\": {\"if\": [{\"get_param\": \"GlanceDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"glance::policy::policies\": {\"get_param\": \"GlanceApiPolicies\"}, \"glance::api::authtoken::project_name\": \"service\", \"glance::api::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"glance::api::authtoken::user_domain_name\": \"Default\", \"glance::api::authtoken::project_domain_name\": \"Default\", \"glance::api::authtoken::interface\": \"internal\", \"glance::api::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"glance::api::pipeline\": {\"if\": [{\"get_param\": \"GlanceCacheEnabled\"}, \"keystone+cachemanagement\", \"keystone\"]}, \"glance::api::os_region_name\": {\"get_param\": \"KeystoneRegion\"}, \"glance::api::image_member_quota\": {\"get_param\": \"GlanceImageMemberQuota\"}, \"glance::api::enabled_import_methods\": {\"get_param\": \"GlanceEnabledImportMethods\"}, \"glance::api::node_staging_uri\": {\"get_param\": \"GlanceNodeStagingUri\"}, \"glance::api::image_import_plugins\": {\"if\": [\"force_image_conversion_plugin\", {\"list_concat_unique\": [{\"get_param\": \"GlanceImageImportPlugins\"}, [\"image_conversion\"]]}, {\"get_param\": \"GlanceImageImportPlugins\"}]}, \"glance::api::image_conversion_output_format\": {\"get_param\": \"GlanceImageConversionOutputFormat\"}, \"glance::api::inject_metadata_properties\": {\"get_param\": \"GlanceInjectMetadataProperties\"}, \"glance::api::ignore_user_roles\": {\"get_param\": \"GlanceIgnoreUserRoles\"}, \"tripleo::profile::base::glance::api::tls_proxy_bind_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}}}, \"tripleo::profile::base::glance::api::tls_proxy_fqdn\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}}}, \"tripleo::profile::base::glance::api::tls_proxy_port\": 9292, \"glance::api::bind_host\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, \"%{hiera('localhost_address')}\", {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}}}}]}, \"glance_notifier_strategy\": {\"get_param\": \"GlanceNotifierStrategy\"}, \"glance_log_file\": {\"get_param\": \"GlanceLogFile\"}, \"glance::backend::rbd::rbd_thin_provisioning\": {\"get_param\": \"GlanceSparseUploadEnabled\"}, \"glance::backend::file::filesystem_thin_provisioning\": {\"get_param\": \"GlanceSparseUploadEnabled\"}, \"glance::backend::swift::swift_store_auth_address\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"glance::backend::swift::swift_store_user\": \"service:glance\", \"glance::backend::swift::swift_store_key\": {\"get_param\": \"GlancePassword\"}, \"glance::backend::swift::swift_store_create_container_on_put\": true, \"glance::backend::swift::swift_store_auth_version\": 3, \"glance::backend::rbd::rbd_store_ceph_conf\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"glance::backend::rbd::rbd_store_pool\": {\"get_param\": \"GlanceRbdPoolName\"}, \"glance::backend::rbd::rbd_store_user\": {\"get_param\": \"CephClientUserName\"}, \"glance_backend\": {\"get_param\": \"GlanceBackend\"}, \"tripleo::profile::base::glance::api::glance_backend_id\": {\"get_param\": \"GlanceBackendID\"}, \"tripleo::profile::base::glance::api::glance_store_description\": {\"get_param\": \"GlanceStoreDescription\"}, \"tripleo::profile::base::glance::api::multistore_config\": {\"get_param\": \"GlanceMultistoreConfig\"}, \"tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"glance::notify::rabbitmq::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"glance::notify::rabbitmq::rabbit_heartbeat_in_pthread\": false, \"glance::cron::db_purge::minute\": {\"get_param\": \"GlanceCronDbPurgeMinute\"}, \"glance::cron::db_purge::hour\": {\"get_param\": \"GlanceCronDbPurgeHour\"}, \"glance::cron::db_purge::monthday\": {\"get_param\": \"GlanceCronDbPurgeMonthday\"}, \"glance::cron::db_purge::month\": {\"get_param\": \"GlanceCronDbPurgeMonth\"}, \"glance::cron::db_purge::weekday\": {\"get_param\": \"GlanceCronDbPurgeWeekday\"}, \"glance::cron::db_purge::user\": {\"get_param\": \"GlanceCronDbPurgeUser\"}, \"glance::cron::db_purge::age\": {\"get_param\": \"GlanceCronDbPurgeAge\"}, \"glance::cron::db_purge::max_rows\": {\"get_param\": \"GlanceCronDbPurgeMaxRows\"}, \"glance::cron::db_purge::destination\": {\"get_param\": \"GlanceCronDbPurgeDestination\"}, \"glance::cron::db_purge::maxdelay\": {\"get_param\": \"GlanceCronDbPurgeMaxDelay\"}}, {\"if\": [\"glance_workers_set\", {\"glance::api::workers\": {\"get_param\": \"GlanceWorkers\"}}]}, {\"if\": [{\"get_param\": \"EnforceSecureRbac\"}, {\"glance::api::enforce_secure_rbac\": true, \"glance::policy::enforce_new_defaults\": true}]}, {\"if\": [\"cinder_backend_enabled\", {\"glance::backend::cinder::cinder_store_auth_address\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"glance::backend::cinder::cinder_store_project_name\": \"service\", \"glance::backend::cinder::cinder_store_user_name\": \"glance\", \"glance::backend::cinder::cinder_store_password\": {\"get_param\": \"GlancePassword\"}, \"glance::api::lock_path\": {\"get_param\": \"GlanceCinderLockPath\"}, \"tripleo::profile::base::glance::backend::cinder::cinder_mount_point_base\": {\"get_param\": \"GlanceCinderMountPointBase\"}, \"tripleo::profile::base::glance::backend::cinder::cinder_volume_type\": {\"get_param\": \"GlanceCinderVolumeType\"}}]}, {\"if\": [\"cinder_multipathd_enabled\", {\"glance::backend::cinder::cinder_use_multipath\": true}]}, {\"if\": [{\"get_param\": \"GlanceCacheEnabled\"}, {\"tripleo::profile::base::glance::api::glance_enable_cache\": true, \"glance::api::image_cache_dir\": {\"get_param\": \"GlanceImageCacheDir\"}, \"glance::api::image_cache_max_size\": {\"get_param\": \"GlanceImageCacheMaxSize\"}, \"glance::api::image_cache_stall_time\": {\"get_param\": \"GlanceImageCacheStallTime\"}, \"glance::api::cache_prefetcher_interval\": {\"get_param\": \"GlanceImagePrefetcherInterval\"}}]}, {\"if\": [{\"get_param\": \"GlanceNetappNfsEnabled\"}, {\"tripleo::profile::base::glance::netapp::netapp_share\": {\"get_param\": \"NetappShareLocation\"}, \"glance::api::filesystem_store_metadata_file\": \"/etc/glance/glance-metadata-file.json\", \"glance::api::filesystem_store_file_perm\": \"0644\"}]}, {\"if\": [{\"contains\": [\"glance-direct\", {\"get_param\": \"GlanceEnabledImportMethods\"}]}, {\"glance::api::worker_self_reference_url\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"str_replace\": {\"template\": \"https://%{hiera('fqdn_NETWORK')}:PORT\", \"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}, \"PORT\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}}}}, {\"str_replace\": {\"template\": \"http://%{hiera('NETWORK_uri')}:PORT\", \"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GlanceApiNetwork\"]}, \"PORT\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}}}}]}}]}, {\"if\": [{\"not\": {\"equals\": [{\"get_param\": \"GlanceDiskFormats\"}, []]}}, {\"glance::api::disk_formats\": {\"get_param\": \"GlanceDiskFormats\"}}]}]}, \"service_config_settings\": {\"mysql\": {\"glance::db::mysql::password\": {\"get_param\": \"GlancePassword\"}, \"glance::db::mysql::user\": \"glance\", \"glance::db::mysql::host\": \"%\", \"glance::db::mysql::dbname\": \"glance\"}, \"rsyslog\": {\"tripleo_logging_sources_glance_api\": [{\"get_param\": \"GlanceApiLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"glance_api\", \"puppet_tags\": \"glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::glance::api\", {\"if\": [{\"get_param\": \"GlanceNetappNfsEnabled\"}, \"include tripleo::profile::base::glance::netapp\"]}, {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/glance_api.json\": {\"command\": \"/usr/bin/glance-api --config-file /usr/share/glance/glance-api-dist.conf --config-file /etc/glance/glance-api.conf --config-file /etc/glance/glance-image-import.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-iscsid/*\", \"dest\": \"/etc/iscsi/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": {\"list_concat\": [[{\"path\": \"/var/lib/glance\", \"owner\": \"glance:glance\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"glance:glance\", \"perm\": \"0600\"}], {\"repeat\": {\"template\": {\"path\": \"/etc/ceph/<%keyring%>\", \"owner\": \"glance:glance\", \"perm\": \"0600\"}, \"for_each\": {\"<%keyring%>\": {\"yaql\": {\"expression\": \"let(u => $.data.user) -> $.data.multistore.values().where($.get(\\\"CephClusterName\\\")).select($.CephClusterName + \\\".client.\\\" + $.get(\\\"CephClientUserName\\\", $u) +\\\".keyring\\\")\", \"data\": {\"user\": {\"get_param\": \"CephClientUserName\"}, \"multistore\": {\"get_param\": \"GlanceMultistoreConfig\"}}}}}}}]}}, \"/var/lib/kolla/config_files/glance_api_tls_proxy.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/glance_api_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/glance\", \"owner\": \"glance:glance\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"GlanceLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"glance_api_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"privileged\": false, \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"GlanceLogging\", \"volumes\"]}, {\"get_param\": \"GlanceApiOptVolumes\"}, [\"/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json\", \"/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, \"/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro\", \"/var/lib/glance:/var/lib/glance:shared\"], {\"if\": [\"cinder_backend_enabled\", {\"list_concat\": [[\"/dev:/dev\", \"/var/lib/iscsi:/var/lib/iscsi:z\", {\"list_join\": [\":\", [{\"get_param\": \"GlanceCinderLockPath\"}, {\"get_param\": \"GlanceCinderLockPath\"}, \"z\"]]}], {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_volumes\"]}]}]}, {\"if\": [\"cinder_multipathd_enabled\", [\"/etc/multipath:/etc/multipath:z\", \"/etc/multipath.conf:/etc/multipath.conf:ro\"]]}]}, \"environment\": {\"KOLLA_BOOTSTRAP\": true, \"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}, \"command\": \"/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'\"}}, \"step_4\": {\"glance_api\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiImage\"]}, \"net\": \"host\", \"privileged\": {\"if\": [\"cinder_backend_enabled\", true, false]}, \"restart\": \"always\", \"depends_on\": {\"if\": [{\"or\": [{\"get_param\": \"GlanceNfsEnabled\"}, {\"get_param\": \"GlanceNetappNfsEnabled\"}]}, \"var-lib-glance-images.mount\"]}, \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"GlanceLogging\", \"volumes\"]}, {\"get_param\": \"GlanceApiOptVolumes\"}, [\"/var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json\", \"/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, \"/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro\", \"/var/lib/glance:/var/lib/glance:shared\"], {\"if\": [\"cinder_backend_enabled\", {\"list_concat\": [[\"/dev:/dev\", \"/var/lib/iscsi:/var/lib/iscsi:z\", {\"list_join\": [\":\", [{\"get_param\": \"GlanceCinderLockPath\"}, {\"get_param\": \"GlanceCinderLockPath\"}, \"z\"]]}], {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_volumes\"]}]}]}, {\"if\": [\"cinder_multipathd_enabled\", [\"/etc/multipath:/etc/multipath:z\", \"/etc/multipath.conf:/etc/multipath.conf:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"glance_api_tls_proxy\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"start_order\": 3, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"GlanceLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/glance_api_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro\", \"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}]}, \"glance_api_cron\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron glance\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"GlanceLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/glance_api_cron.json:/var/lib/kolla/config_files/config.json\", \"/var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro\", \"/var/lib/glance:/var/lib/glance:shared\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"GlanceLogging\", \"host_prep_tasks\"]}, [{\"name\": \"Mount NFS on host\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GlanceNfsEnabled\"}, \"glance_netapp_nfs_enabled\": {\"get_param\": \"GlanceNetappNfsEnabled\"}, \"glance_nfs_share\": {\"get_param\": \"GlanceNfsShare\"}, \"netapp_share_location\": {\"get_param\": \"NetappShareLocation\"}, \"nfs_share\": \"{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}\", \"nfs_options\": {\"get_param\": \"GlanceNfsOptions\"}}, \"mount\": {\"name\": \"/var/lib/glance/images\", \"state\": \"mounted\", \"fstype\": \"nfs\", \"src\": \"{{nfs_share}}\", \"opts\": \"{{nfs_options}}\"}, \"when\": \"nfs_backend_enabled or glance_netapp_nfs_enabled\"}, {\"name\": \"Mount Node Staging Location\", \"vars\": {\"glance_node_staging_uri\": {\"get_param\": \"GlanceNodeStagingUri\"}, \"glance_staging_nfs_share\": {\"get_param\": \"GlanceStagingNfsShare\"}, \"glance_nfs_options\": {\"get_param\": \"GlanceStagingNfsOptions\"}}, \"mount\": {\"name\": \"{{glance_node_staging_uri[7:]}}\", \"state\": \"mounted\", \"fstype\": \"nfs\", \"src\": \"{{glance_staging_nfs_share}}\", \"opts\": \"{{glance_nfs_options}}\"}, \"when\": \"glance_staging_nfs_share != ''\"}], [{\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}, {\"name\": \"ensure /var/lib/glance exists\", \"file\": {\"path\": \"/var/lib/glance\", \"state\": \"directory\", \"setype\": \"container_file_t\"}}], {\"if\": [\"cinder_backend_enabled\", [{\"name\": \"Allow glance to use cinder's lock_path\", \"file\": {\"path\": {\"get_param\": \"GlanceCinderLockPath\"}, \"state\": \"directory\", \"setype\": \"container_file_t\", \"mode\": 504, \"group\": 42400}}, {\"name\": \"Identify dynamic os-brick lock files used by glance\", \"vars\": {\"lock_path\": {\"get_param\": \"GlanceCinderLockPath\"}}, \"ansible.builtin.find\": {\"paths\": \"{{ lock_path }}\", \"patterns\": \"os-brick-connect_to_iscsi_portal-*\"}, \"register\": \"find_dynamic_locks\"}, {\"name\": \"Prepare the os-brick lock files used by glance\", \"vars\": {\"lock_path\": {\"get_param\": \"GlanceCinderLockPath\"}, \"static_brick_locks\": [\"{{ lock_path }}/os-brick-connect_volume\", \"{{ lock_path }}/os-brick-extend_volume\", \"{{ lock_path }}/scaleio-scaleio\"], \"dynamic_brick_locks\": \"{{ find_dynamic_locks.files | map(attribute='path') }}\"}, \"file\": {\"path\": \"{{ item }}\", \"state\": \"touch\", \"setype\": \"container_file_t\", \"mode\": 432, \"group\": 42400}, \"loop\": \"{{ (static_brick_locks + dynamic_brick_locks) | flatten}}\"}]]}, {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_host_prep_tasks\"]}]}, \"upgrade_tasks\": [{\"name\": \"glance-api pre system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 3\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Unmount and remove NFS glance entry\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GlanceNfsEnabled\"}, \"glance_netapp_nfs_enabled\": {\"get_param\": \"GlanceNetappNfsEnabled\"}}, \"mount\": {\"name\": \"/var/lib/glance/images\", \"fstype\": \"nfs\", \"state\": \"absent\"}, \"when\": \"nfs_backend_enabled or glance_netapp_nfs_enabled\"}, {\"name\": \"Unmount and remove NFS glance-staging entry\", \"vars\": {\"glance_node_staging_uri\": {\"get_param\": \"GlanceNodeStagingUri\"}, \"glance_staging_nfs_share\": {\"get_param\": \"GlanceStagingNfsShare\"}}, \"mount\": {\"name\": \"{{glance_node_staging_uri[7:]}}\", \"fstype\": \"nfs\", \"state\": \"absent\"}, \"when\": \"glance_staging_nfs_share != ''\"}]}, {\"name\": \"glance-api post system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 5\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Mount NFS on host\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GlanceNfsEnabled\"}, \"glance_netapp_nfs_enabled\": {\"get_param\": \"GlanceNetappNfsEnabled\"}, \"glance_nfs_share\": {\"get_param\": \"GlanceNfsShare\"}, \"netapp_share_location\": {\"get_param\": \"NetappShareLocation\"}, \"nfs_share\": \"{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}\", \"nfs_options\": {\"get_param\": \"GlanceNfsOptions\"}}, \"mount\": {\"name\": \"/var/lib/glance/images\", \"state\": \"mounted\", \"fstype\": \"nfs\", \"src\": \"{{nfs_share}}\", \"opts\": \"{{nfs_options}}\"}, \"when\": \"nfs_backend_enabled or glance_netapp_nfs_enabled\"}, {\"name\": \"Mount Node Staging Location\", \"vars\": {\"glance_node_staging_uri\": {\"get_param\": \"GlanceNodeStagingUri\"}, \"glance_staging_nfs_share\": {\"get_param\": \"GlanceStagingNfsShare\"}, \"glance_nfs_options\": {\"get_param\": \"GlanceStagingNfsOptions\"}}, \"mount\": {\"name\": \"{{glance_node_staging_uri[7:]}}\", \"state\": \"mounted\", \"fstype\": \"nfs\", \"src\": \"{{glance_staging_nfs_share}}\", \"opts\": \"{{glance_nfs_options}}\"}, \"when\": \"glance_staging_nfs_share != ''\"}]}], \"metadata_settings\": {\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"metadata_settings\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop glance api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"glance_api\", \"glance_api_cron\"], \"tripleo_delegate_to\": \"{{ groups['glance_api'] | difference(groups['excluded_overcloud']) }}\"}}]}], \"deploy_steps_tasks\": {\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"deploy_steps_tasks\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/glance/glance-api-internal-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Glance internal service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"GlanceApiInternalLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.glance.api\", \"file\": \"/var/log/containers/glance/api_internal.log\"}}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"GlanceNetappNfsEnabled\": {\"default\": false, \"description\": \"When using GlanceBackend 'file', Netapp mount NFS share for image storage.\\n\", \"type\": \"boolean\"}, \"ContainerGlanceApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerGlanceApiInternalConfigImage\": {\"description\": \"The container image to use for the glance_api_internal config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"GlanceApi\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/glance/glance-api-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"GlanceLogging\": {\"type\": \"OS::TripleO::Services::Logging::GlanceApi\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerGlanceApiImage\": \"ContainerGlanceApiImage\", \"ContainerGlanceApiInternalConfigImage\": \"ContainerGlanceApiInternalConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerGlanceApiImage\": {\"get_param\": \"ContainerGlanceApiImage\"}, \"ContainerGlanceApiInternalConfigImage\": {\"get_param\": \"ContainerGlanceApiInternalConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the internal Glance API.\", \"value\": {\"map_merge\": [{\"get_attr\": [\"GlanceApi\", \"role_data\"]}, {\"service_name\": \"glance_api_internal\", \"firewall_rules\": {\"112 glance_api_internal\": {\"dport\": [{\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}]}}, \"firewall_frontend_rules\": {\"100 glance_api_internal_haproxy_frontend\": {\"dport\": [{\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}]}}, \"keystone_resources\": {}, \"config_settings\": {\"get_attr\": [\"GlanceApi\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"map_merge\": [{\"get_attr\": [\"GlanceApi\", \"role_data\", \"service_config_settings\"]}, {\"rsyslog\": {\"tripleo_logging_sources_glance_api_internal\": [{\"get_param\": \"GlanceApiInternalLoggingSource\"}]}}]}, \"puppet_config\": {\"config_volume\": \"glance_api_internal\", \"puppet_tags\": \"glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config\", \"step_config\": {\"list_join\": [\"\\n\", [{\"str_replace\": {\"template\": \"class { 'tripleo::profile::base::glance::api':\\n  bind_port => PORT,\\n  tls_proxy_port => PORT,\\n  log_file => '/var/log/glance/api_internal.log',\\n  show_image_direct_url => true,\\n  show_multiple_locations => true,\\n}\\n\", \"params\": {\"PORT\": {\"get_param\": [\"EndpointMap\", \"GlanceInternal\", \"port\"]}}}}, {\"if\": [{\"get_param\": \"GlanceNetappNfsEnabled\"}, \"include tripleo::profile::base::glance::netapp\"]}, {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiInternalConfigImage\"]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"GlanceLogging\", \"docker_config\", \"step_2\"]}, \"step_4\": {\"glance_api_internal\": {\"map_merge\": [{\"get_attr\": [\"GlanceApi\", \"role_data\", \"docker_config\", \"step_4\", \"glance_api\"]}, {\"volumes\": {\"yaql\": {\"expression\": \"$.data.vols.select($.replace('puppet-generated/glance_api', 'puppet-generated/glance_api_internal'))\", \"data\": {\"vols\": {\"get_attr\": [\"GlanceApi\", \"role_data\", \"docker_config\", \"step_4\", \"glance_api\", \"volumes\"]}}}}}]}, \"glance_api_internal_tls_proxy\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"map_merge\": [{\"get_attr\": [\"GlanceApi\", \"role_data\", \"docker_config\", \"step_4\", \"glance_api_tls_proxy\"]}, {\"volumes\": {\"yaql\": {\"expression\": \"$.data.vols.select($.replace('puppet-generated/glance_api', 'puppet-generated/glance_api_internal'))\", \"data\": {\"vols\": {\"get_attr\": [\"GlanceApi\", \"role_data\", \"docker_config\", \"step_4\", \"glance_api_tls_proxy\", \"volumes\"]}}}}}]}]}}}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop glance api internal container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"glance_api_internal\"], \"tripleo_delegate_to\": \"{{ groups['glance_api_internal'] | default([]) }}\"}}]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/heat/heat-base-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Openstack Heat base service. Shared for all Heat services.\\n\", \"parameters\": {\"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"HeatDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Heat services.\", \"type\": \"boolean\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"HeatPassword\": {\"description\": \"The password for the Heat service and db account, used by the Heat services.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnableCache\": {\"description\": \"Enable caching with memcached\", \"type\": \"boolean\", \"default\": true}, \"HeatCronPurgeDeletedEnsure\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Ensure\\n\", \"default\": \"present\"}, \"HeatCronPurgeDeletedMinute\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Minute\\n\", \"default\": \"1\"}, \"HeatCronPurgeDeletedHour\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Hour\\n\", \"default\": \"0\"}, \"HeatCronPurgeDeletedMonthday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month Day\\n\", \"default\": \"*\"}, \"HeatCronPurgeDeletedMonth\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month\\n\", \"default\": \"*\"}, \"HeatCronPurgeDeletedWeekday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Week Day\\n\", \"default\": \"*\"}, \"HeatCronPurgeDeletedMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Max Delay\\n\", \"default\": \"3600\"}, \"HeatCronPurgeDeletedUser\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - User\\n\", \"default\": \"heat\"}, \"HeatCronPurgeDeletedAge\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Age\\n\", \"default\": \"30\"}, \"HeatCronPurgeDeletedAgeType\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Age type\\n\", \"default\": \"days\"}, \"HeatCronPurgeDeletedDestination\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Log destination\\n\", \"default\": \"/dev/null\"}, \"HeatYaqlLimitIterators\": {\"type\": \"number\", \"description\": \"The maximum number of elements in collection yaql expressions can take for its evaluation.\\n\", \"default\": 1000}, \"HeatYaqlMemoryQuota\": {\"type\": \"number\", \"description\": \"The maximum size of memory in bytes that yaql exrpessions can take for its evaluation.\\n\", \"default\": 100000}, \"HeatMaxJsonBodySize\": {\"default\": 4194304, \"description\": \"Maximum raw byte size of the Heat API JSON request body.\", \"type\": \"number\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"HeatCorsAllowedOrigin\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Indicate whether this resource may be shared with the domain received in the request \\\"origin\\\" header.\"}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"HeatApiPolicies\": {\"description\": \"A hash of policies to configure for Heat API.\\ne.g. { heat-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}}, \"conditions\": {\"tls_cache_enabled\": {\"and\": [{\"get_param\": \"EnableCache\"}, {\"get_param\": \"MemcachedTLS\"}]}, \"cors_allowed_origin_set\": {\"not\": {\"equals\": [{\"get_param\": \"HeatCorsAllowedOrigin\"}, \"\"]}}}, \"outputs\": {\"role_data\": {\"description\": \"Shared role data for the Heat services.\", \"value\": {\"service_name\": \"heat_base\", \"config_settings\": {\"map_merge\": [{\"if\": [{\"get_param\": \"EnforceSecureRbac\"}, {\"heat::policy::enforce_scope\": true, \"heat::policy::enforce_new_defaults\": true}]}, {\"if\": [\"cors_allowed_origin_set\", {\"heat::cors::allowed_origin\": {\"get_param\": \"HeatCorsAllowedOrigin\"}}]}, {\"heat::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"heat::logging::debug\": {\"if\": [{\"get_param\": \"HeatDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"heat::policy::policies\": {\"get_param\": \"HeatApiPolicies\"}, \"heat::enable_proxy_headers_parsing\": true, \"heat::rpc_response_timeout\": 600, \"heat::rabbit_heartbeat_timeout_threshold\": 60, \"heat::rabbit_heartbeat_in_pthread\": false, \"heat::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"heat::keystone::authtoken::project_name\": \"service\", \"heat::keystone::authtoken::user_domain_name\": \"Default\", \"heat::keystone::authtoken::project_domain_name\": \"Default\", \"heat::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"heat::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"heat::keystone::authtoken::password\": {\"get_param\": \"HeatPassword\"}, \"heat::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"heat::keystone::authtoken::interface\": \"internal\", \"heat::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"heat::keystone::domain::domain_name\": \"heat_stack\", \"heat::keystone::domain::domain_admin\": \"heat_stack_domain_admin\", \"heat::keystone::domain::domain_admin_email\": \"heat_stack_domain_admin@localhost\", \"heat::db::database_db_max_retries\": -1, \"heat::db::database_max_retries\": -1, \"heat::yaql_memory_quota\": {\"get_param\": \"HeatYaqlMemoryQuota\"}, \"heat::yaql_limit_iterators\": {\"get_param\": \"HeatYaqlLimitIterators\"}, \"heat::cors::max_age\": 3600, \"heat::cors::allow_headers\": \"Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token\", \"heat::cors::expose_headers\": \"Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma\", \"heat::cron::purge_deleted::ensure\": {\"get_param\": \"HeatCronPurgeDeletedEnsure\"}, \"heat::cron::purge_deleted::minute\": {\"get_param\": \"HeatCronPurgeDeletedMinute\"}, \"heat::cron::purge_deleted::hour\": {\"get_param\": \"HeatCronPurgeDeletedHour\"}, \"heat::cron::purge_deleted::monthday\": {\"get_param\": \"HeatCronPurgeDeletedMonthday\"}, \"heat::cron::purge_deleted::month\": {\"get_param\": \"HeatCronPurgeDeletedMonth\"}, \"heat::cron::purge_deleted::weekday\": {\"get_param\": \"HeatCronPurgeDeletedWeekday\"}, \"heat::cron::purge_deleted::maxdelay\": {\"get_param\": \"HeatCronPurgeDeletedMaxDelay\"}, \"heat::cron::purge_deleted::user\": {\"get_param\": \"HeatCronPurgeDeletedUser\"}, \"heat::cron::purge_deleted::age\": {\"get_param\": \"HeatCronPurgeDeletedAge\"}, \"heat::cron::purge_deleted::age_type\": {\"get_param\": \"HeatCronPurgeDeletedAgeType\"}, \"heat::cron::purge_deleted::destination\": {\"get_param\": \"HeatCronPurgeDeletedDestination\"}, \"heat::max_json_body_size\": {\"get_param\": \"HeatMaxJsonBodySize\"}}, {\"heat::cache::enabled\": {\"get_param\": \"EnableCache\"}, \"heat::cache::tls_enabled\": {\"get_param\": \"MemcachedTLS\"}, \"heat::cache::resource_finder_caching\": false}, {\"if\": [\"tls_cache_enabled\", {\"heat::cache::backend\": \"dogpile.cache.pymemcache\"}, {\"heat::cache::backend\": \"dogpile.cache.memcached\"}]}]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/heat/heat-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Heat API service\\n\", \"parameters\": {\"ContainerHeatApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerHeatApiConfigImage\": {\"description\": \"The container image to use for the heat_api config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"HeatApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.heat.api\", \"file\": \"/var/log/containers/heat/heat_api.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"HeatApiOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\"}, \"HeatApiOptEnvVars\": {\"default\": {}, \"description\": \"hash of optional environment variables\", \"type\": \"json\"}, \"HeatWorkers\": {\"default\": 0, \"description\": \"Number of workers for Heat service.\", \"type\": \"number\"}, \"HeatPassword\": {\"description\": \"The password for the Heat service and db account, used by the Heat services.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionHeatApi\": {\"default\": \"overcloud-heat-api\", \"type\": \"string\"}, \"HeatStackDomainAdminPassword\": {\"description\": \"Password for heat_stack_domain_admin user.\", \"type\": \"string\", \"hidden\": true}}, \"conditions\": {\"heat_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"HeatWorkers\"}, 0]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"HeatBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/heat/heat-base-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"HeatApiLogging\": {\"type\": \"OS::TripleO::Services::Logging::HeatApi\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHeatApiImage\": \"ContainerHeatApiImage\", \"ContainerHeatApiConfigImage\": \"ContainerHeatApiConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHeatApiImage\": {\"get_param\": \"ContainerHeatApiImage\"}, \"ContainerHeatApiConfigImage\": {\"get_param\": \"ContainerHeatApiConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Heat API role.\", \"value\": {\"service_name\": \"heat_api\", \"firewall_rules\": {\"125 heat_api\": {\"dport\": [8004]}}, \"firewall_frontend_rules\": {\"100 heat_api_haproxy_frontend\": {\"dport\": [8004]}}, \"firewall_ssl_frontend_rules\": {\"100 heat_api_haproxy_frontend_ssl\": {\"dport\": [13004]}}, \"keystone_resources\": {\"heat\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"HeatPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"HeatInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"HeatAdmin\", \"uri\"]}}, \"users\": {\"heat\": {\"password\": {\"get_param\": \"HeatPassword\"}}, \"heat_stack_domain_admin\": {\"password\": {\"get_param\": \"HeatStackDomainAdminPassword\"}, \"roles\": [\"admin\"], \"domain\": \"heat_stack\"}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"orchestration\", \"roles\": [\"heat_stack_user\"], \"domains\": [\"heat_stack\"]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionHeatApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"HeatBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"HeatApiLogging\", \"config_settings\"]}, {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"apache::default_vhost\": false, \"heat::api::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}}}, \"heat::wsgi::apache_api::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"heat::wsgi::apache_api::vhost_custom_fragment\": \"Timeout 600\", \"heat::api::service_name\": \"httpd\", \"heat::wsgi::apache_api::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}}}, \"heat::wsgi::apache_api::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiNetwork\"]}}}}}, {\"if\": [\"heat_workers_set\", {\"heat::wsgi::apache_api::workers\": {\"get_param\": \"HeatWorkers\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_heat_api\": [{\"get_param\": \"HeatApiLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"heat_api\", \"puppet_tags\": \"heat_config,file,concat,file_line,heat_api_paste_ini\", \"step_config\": \"include tripleo::profile::base::heat::api\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatApiConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/heat_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/heat\", \"owner\": \"heat:heat\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/heat_api_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/heat\", \"owner\": \"heat:heat\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"HeatApiLogging\", \"docker_config\", \"step_2\"]}, \"step_4\": {\"heat_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatApiImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"user\": \"root\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"HeatApiLogging\", \"volumes\"]}, {\"get_param\": \"HeatApiOptVolumes\"}, [\"/var/lib/kolla/config_files/heat_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"map_merge\": [{\"get_param\": \"HeatApiOptEnvVars\"}, {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}]}}, \"heat_api_cron\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron heat\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"HeatApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/heat_api_cron.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/heat_api:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"get_attr\": [\"HeatApiLogging\", \"host_prep_tasks\"]}, \"upgrade_tasks\": [], \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop heat api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"heat_api\", \"heat_api_cron\"], \"tripleo_delegate_to\": \"{{ groups['heat_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/heat/heat-api-cfn-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Heat API CFN service\\n\", \"parameters\": {\"ContainerHeatApiCfnImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerHeatApiCfnConfigImage\": {\"description\": \"The container image to use for the heat_api_cfn config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"HeatApiCfnLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.heat.api.cfn\", \"file\": \"/var/log/containers/heat/heat_api_cfn.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"HeatWorkers\": {\"default\": 0, \"description\": \"Number of workers for Heat service.\", \"type\": \"number\"}, \"HeatPassword\": {\"description\": \"The password for the Heat service and db account, used by the Heat services.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionHeatApiCnf\": {\"default\": \"overcloud-heat-api-cfn\", \"type\": \"string\"}}, \"conditions\": {\"heat_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"HeatWorkers\"}, 0]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"HeatBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/heat/heat-base-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"HeatApiCfnLogging\": {\"type\": \"OS::TripleO::Services::Logging::HeatApiCfn\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHeatApiCfnImage\": \"ContainerHeatApiCfnImage\", \"ContainerHeatApiCfnConfigImage\": \"ContainerHeatApiCfnConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHeatApiCfnImage\": {\"get_param\": \"ContainerHeatApiCfnImage\"}, \"ContainerHeatApiCfnConfigImage\": {\"get_param\": \"ContainerHeatApiCfnConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Heat API CFN role.\", \"value\": {\"service_name\": \"heat_api_cfn\", \"firewall_rules\": {\"125 heat_cfn\": {\"dport\": [8000]}}, \"firewall_frontend_rules\": {\"100 heat_api_cfn_haproxy_frontend\": {\"dport\": [8000]}}, \"firewall_ssl_frontend_rules\": {\"100 heat_api_cfn_haproxy_frontend_ssl\": {\"dport\": [13005]}}, \"keystone_resources\": {\"heat-cfn\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"HeatCfnInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"HeatCfnAdmin\", \"uri\"]}}, \"users\": {\"heat-cfn\": {\"password\": {\"get_param\": \"HeatPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"cloudformation\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionHeatApiCnf\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"HeatBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"HeatApiCfnLogging\", \"config_settings\"]}, {\"apache::default_vhost\": false, \"heat::api_cfn::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiCfnNetwork\"]}}}}, \"heat::wsgi::apache_api_cfn::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"heat::api_cfn::service_name\": \"httpd\", \"heat::wsgi::apache_api_cfn::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiCfnNetwork\"]}}}}, \"heat::wsgi::apache_api_cfn::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HeatApiCfnNetwork\"]}}}}}, {\"if\": [\"heat_workers_set\", {\"heat::wsgi::apache_api_cfn::workers\": {\"get_param\": \"HeatWorkers\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_heat_api_cfn\": [{\"get_param\": \"HeatApiCfnLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"heat_api_cfn\", \"puppet_tags\": \"heat_config,file,concat,file_line\", \"step_config\": \"include tripleo::profile::base::heat::api_cfn\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatApiCfnConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/heat_api_cfn.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/heat\", \"owner\": \"heat:heat\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"HeatApiCfnLogging\", \"docker_config\", \"step_2\"]}, \"step_4\": {\"heat_api_cfn\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatApiCfnImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"user\": \"root\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"HeatApiCfnLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/heat_api_cfn.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/heat_api_cfn:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"get_attr\": [\"HeatApiCfnLogging\", \"host_prep_tasks\"]}, \"upgrade_tasks\": [], \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop heat cfn container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"heat_api_cfn\"], \"tripleo_delegate_to\": \"{{ groups['heat_api_cfn'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/heat/heat-api-cloudwatch-disabled-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Openstack Heat CloudWatch API service, disabled by default since Pike\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the disabled Heat CloudWatch API\", \"value\": {\"service_name\": \"heat_api_cloudwatch_disabled\", \"upgrade_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/heat/heat-engine-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Heat Engine service\\n\", \"parameters\": {\"ContainerHeatEngineImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerHeatConfigImage\": {\"description\": \"The container image to use for the heat config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"HeatEngineLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.heat.engine\", \"file\": \"/var/log/containers/heat/heat-engine.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"HeatEngineOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\"}, \"HeatEngineOptEnvVars\": {\"default\": {}, \"description\": \"hash of optional environment variables\", \"type\": \"json\"}, \"HeatEnableDBPurge\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Whether to create cron job for purging soft deleted rows in the Heat database.\\n\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"HeatWorkers\": {\"default\": 0, \"description\": \"Number of workers for Heat service.\", \"type\": \"number\"}, \"HeatMaxNestedStackDepth\": {\"default\": 6, \"description\": \"Maximum number of nested stack depth.\", \"type\": \"number\"}, \"HeatReauthenticationAuthMethod\": {\"description\": \"Allow reauthentication on token expiry, such that long-running tasks may complete. Note this defeats the expiry of any provided user tokens.\", \"type\": \"string\", \"default\": \"\", \"constraints\": [{\"allowed_values\": [\"\", \"trusts\"]}]}, \"HeatPassword\": {\"description\": \"The password for the Heat service and db account, used by the Heat services.\", \"type\": \"string\", \"hidden\": true}, \"HeatStackDomainAdminPassword\": {\"description\": \"Password for heat_stack_domain_admin user.\", \"type\": \"string\", \"hidden\": true}, \"HeatAuthEncryptionKey\": {\"description\": \"Auth encryption key for heat-engine\", \"type\": \"string\", \"hidden\": true, \"default\": \"\"}, \"MonitoringSubscriptionHeatEngine\": {\"default\": \"overcloud-heat-engine\", \"type\": \"string\"}, \"HeatConvergenceEngine\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Enables the heat engine with the convergence architecture.\"}, \"HeatMaxResourcesPerStack\": {\"type\": \"number\", \"default\": 1000, \"description\": \"Maximum resources allowed per top-level stack. -1 stands for unlimited.\"}, \"HeatEnginePluginDirs\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"An array of directories to search for plug-ins.\"}, \"HeatConfigureDelegatedRoles\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Create delegated roles\"}, \"ClientRetryLimit\": {\"type\": \"number\", \"default\": 2, \"description\": \"Client retries for transient errors.\"}}, \"conditions\": {\"heat_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"HeatWorkers\"}, 0]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"HeatBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/heat/heat-base-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"HeatEngineLogging\": {\"type\": \"OS::TripleO::Services::Logging::HeatEngine\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHeatEngineImage\": \"ContainerHeatEngineImage\", \"ContainerHeatConfigImage\": \"ContainerHeatConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHeatEngineImage\": {\"get_param\": \"ContainerHeatEngineImage\"}, \"ContainerHeatConfigImage\": {\"get_param\": \"ContainerHeatConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Heat Engine role.\", \"value\": {\"service_name\": \"heat_engine\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionHeatEngine\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"HeatBase\", \"role_data\", \"config_settings\"]}, {\"apache::default_vhost\": false, \"heat::engine::configure_delegated_roles\": {\"get_param\": \"HeatConfigureDelegatedRoles\"}, \"heat::engine::trusts_delegated_roles\": [], \"heat::engine::max_nested_stack_depth\": {\"get_param\": \"HeatMaxNestedStackDepth\"}, \"heat::engine::max_resources_per_stack\": {\"get_param\": \"HeatMaxResourcesPerStack\"}, \"heat::engine::reauthentication_auth_method\": {\"get_param\": \"HeatReauthenticationAuthMethod\"}, \"heat::engine::heat_metadata_server_url\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"protocol\"]}, \"host\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"host\"]}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"port\"]}}}, \"heat::engine::heat_waitcondition_server_url\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"protocol\"]}, \"host\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"host\"]}, \"port\": {\"get_param\": [\"EndpointMap\", \"HeatCfnPublic\", \"port\"]}, \"path\": \"/v1/waitcondition\"}}, \"heat::engine::convergence_engine\": {\"get_param\": \"HeatConvergenceEngine\"}, \"heat::engine::client_retry_limit\": {\"get_param\": \"ClientRetryLimit\"}, \"tripleo::profile::base::heat::manage_db_purge\": {\"get_param\": \"HeatEnableDBPurge\"}, \"heat::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"heat\", \"password\": {\"get_param\": \"HeatPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/heat\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"heat\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"heat::keystone_ec2_uri\": {\"list_join\": [\"\", [{\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"/ec2tokens\"]]}, \"heat::keystone::domain::domain_password\": {\"get_param\": \"HeatStackDomainAdminPassword\"}, \"heat::engine::auth_encryption_key\": {\"get_param\": \"HeatAuthEncryptionKey\"}, \"heat::engine::plugin_dirs\": {\"get_param\": \"HeatEnginePluginDirs\"}}, {\"if\": [\"heat_workers_set\", {\"heat::engine::num_engine_workers\": {\"get_param\": \"HeatWorkers\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_heat_engine\": [{\"get_param\": \"HeatEngineLoggingSource\"}]}, \"mysql\": {\"heat::db::mysql::password\": {\"get_param\": \"HeatPassword\"}, \"heat::db::mysql::user\": \"heat\", \"heat::db::mysql::host\": \"%\", \"heat::db::mysql::dbname\": \"heat\"}}, \"puppet_config\": {\"config_volume\": \"heat\", \"puppet_tags\": \"heat_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::heat::engine\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/heat_engine.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/heat-engine --config-file /usr/share/heat/heat-dist.conf --config-file /etc/heat/heat.conf\", {\"get_attr\": [\"HeatEngineLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/heat\", \"owner\": \"heat:heat\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/heat_engine_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec heat_engine su heat -s /bin/bash -c 'heat-manage db_sync'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/heat\", \"owner\": \"heat:heat\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"HeatEngineLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"heat_engine_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatEngineImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"privileged\": false, \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"HeatEngineLogging\", \"volumes\"]}, {\"get_param\": \"HeatEngineOptVolumes\"}, [\"/var/lib/kolla/config_files/heat_engine_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"map_merge\": [{\"get_param\": \"HeatEngineOptEnvVars\"}, {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}]}}}, \"step_4\": {\"heat_engine\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatEngineImage\"]}, \"net\": \"host\", \"privileged\": false, \"stop_grace_period\": 60, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"HeatEngineLogging\", \"volumes\"]}, {\"get_param\": \"HeatEngineOptVolumes\"}, [\"/var/lib/kolla/config_files/heat_engine.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/heat:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"map_merge\": [{\"get_param\": \"HeatEngineOptEnvVars\"}, {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}]}}}}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"HeatEngineLogging\", \"host_prep_tasks\"]}, [{\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]]}, \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop heat engine container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"heat_engine\"], \"tripleo_delegate_to\": \"{{ groups['heat_engine'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/kernel/kernel-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Load kernel modules with kmod and configure kernel options with sysctl.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"KernelPidMax\": {\"default\": 1048576, \"description\": \"Configures sysctl kernel.pid_max key\", \"type\": \"number\"}, \"KernelDisableIPv6\": {\"default\": 0, \"description\": \"Configures sysctl net.ipv6.{default/all}.disable_ipv6 keys\", \"type\": \"number\"}, \"KernelIpForward\": {\"default\": 1, \"description\": \"Configures net.ipv4.ip_forward key\", \"type\": \"number\"}, \"KernelIpv6ConfAllForwarding\": {\"default\": 0, \"description\": \"Configures the net.ipv6.conf.all.forwarding key\", \"type\": \"number\"}, \"KernelIpv4ConfAllRpFilter\": {\"default\": 1, \"description\": \"Configures the net.ipv4.conf.all.rp_filter key\", \"type\": \"number\"}, \"KernelIpNonLocalBind\": {\"default\": 1, \"description\": \"Configures net.ipv{4,6}.ip_nonlocal_bind key\", \"type\": \"number\"}, \"NeighbourGcThreshold1\": {\"default\": 1024, \"description\": \"Configures sysctl net.ipv4.neigh.default.gc_thresh1 value. This is the minimum number of entries to keep in the ARP cache. The garbage collector will not run if there are fewer than this number of entries in the cache.\", \"type\": \"number\"}, \"NeighbourGcThreshold2\": {\"default\": 2048, \"description\": \"Configures sysctl net.ipv4.neigh.default.gc_thresh2 value. This is the soft maximum number of entries to keep in the ARP cache. The garbage collector will  allow the number of entries to exceed this for 5 seconds before collection will be performed.\", \"type\": \"number\"}, \"NeighbourGcThreshold3\": {\"default\": 4096, \"description\": \"Configures sysctl net.ipv4.neigh.default.gc_thresh3 value. This is the hard maximum number of entries to keep in the ARP cache. The garbage collector will always run if there are more than this number of entries in the cache.\", \"type\": \"number\"}, \"InotifyInstancesMax\": {\"default\": 1024, \"description\": \"Configures sysctl fs.inotify.max_user_instances key\", \"type\": \"number\"}, \"BridgeNfCallArpTables\": {\"default\": 1, \"description\": \"Configures sysctl net.bridge.bridge-nf-call-arptables key\", \"type\": \"number\"}, \"BridgeNfCallIpTables\": {\"default\": 1, \"description\": \"Configures sysctl net.bridge.bridge-nf-call-iptables key\", \"type\": \"number\"}, \"BridgeNfCallIp6Tables\": {\"default\": 1, \"description\": \"Configures sysctl net.bridge.bridge-nf-call-ip6tables key\", \"type\": \"number\"}, \"ExtraKernelModules\": {\"default\": {}, \"description\": \"Hash of extra Kernel modules to load.\", \"type\": \"json\", \"tags\": [\"role_specific\"]}, \"ExtraKernelPackages\": {\"default\": {}, \"description\": \"List of extra kernel related packages to install.\", \"type\": \"json\", \"tags\": [\"role_specific\"]}, \"ExtraSysctlSettings\": {\"default\": {}, \"description\": \"Hash of extra sysctl settings to apply.\", \"type\": \"json\", \"tags\": [\"role_specific\"]}, \"FsAioMaxNumber\": {\"default\": 0, \"description\": \"The kernel allocates aio memory on demand, and this number limits the number of parallel aio requests; the only drawback of a larger limit is that a malicious guest could issue parallel requests to cause the kernel to set aside memory.  Set this number at least as large as\\n  128 * (number of virtual disks on the host)\\nLibvirt uses a default of 1M requests to allow 8k disks, with at most 64M of kernel memory if all disks hit an aio request at the same time.\\n\", \"type\": \"number\", \"tags\": [\"role_specific\"]}, \"InotifyIntancesMax\": {\"default\": 1024, \"description\": \"Configures sysctl fs.inotify.max_user_instances key\", \"type\": \"number\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"Do not use deprecated params, they will be removed.\", \"parameters\": [\"InotifyIntancesMax\"]}], \"conditions\": {\"ipv6_disabled\": {\"equals\": [{\"get_param\": \"KernelDisableIPv6\"}, 1]}, \"is_inotify_intances_max_default\": {\"equals\": [{\"get_param\": \"InotifyIntancesMax\"}, 1024]}, \"fs_aio_max_number_set\": {\"and\": [{\"not\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"FsAioMaxNumber\"]}, 0]}}, {\"not\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"FsAioMaxNumber\"]}, \"\"]}}]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"extra_kernel_modules\": \"ExtraKernelModules\", \"extra_kernel_packages\": \"ExtraKernelPackages\", \"extra_sysctl_settings\": \"ExtraSysctlSettings\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ExtraKernelModules\": {\"get_param\": \"ExtraKernelModules\"}, \"ExtraKernelPackages\": {\"get_param\": \"ExtraKernelPackages\"}, \"ExtraSysctlSettings\": {\"get_param\": \"ExtraSysctlSettings\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Kernel modules\", \"value\": {\"service_name\": \"kernel\", \"host_prep_tasks\": [{\"include_role\": {\"name\": \"tripleo_kernel\"}}], \"ansible_group_vars\": {\"hieradata_localhost_address\": {\"if\": [\"ipv6_disabled\", \"127.0.0.1\", \"localhost\"]}, \"tripleo_kernel_extra_modules\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"extra_kernel_modules\"]}, \"tripleo_kernel_extra_packages\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"extra_kernel_packages\"]}, \"tripleo_kernel_sysctl_extra_settings\": {\"map_merge\": [{\"net.ipv6.conf.default.disable_ipv6\": {\"value\": {\"get_param\": \"KernelDisableIPv6\"}}, \"net.ipv4.ip_local_reserved_ports\": {\"value\": \"35357,49000-49001\"}, \"net.ipv6.conf.all.disable_ipv6\": {\"value\": {\"get_param\": \"KernelDisableIPv6\"}}, \"net.ipv6.conf.lo.disable_ipv6\": {\"value\": 0}, \"net.ipv4.ip_forward\": {\"value\": {\"get_param\": \"KernelIpForward\"}}, \"net.ipv4.conf.all.rp_filter\": {\"value\": {\"get_param\": \"KernelIpv4ConfAllRpFilter\"}}, \"net.ipv6.conf.all.forwarding\": {\"value\": {\"get_param\": \"KernelIpv6ConfAllForwarding\"}}, \"net.ipv4.ip_nonlocal_bind\": {\"value\": {\"get_param\": \"KernelIpNonLocalBind\"}}, \"net.ipv6.ip_nonlocal_bind\": {\"value\": {\"get_param\": \"KernelIpNonLocalBind\"}}, \"kernel.pid_max\": {\"value\": {\"get_param\": \"KernelPidMax\"}}, \"net.ipv4.neigh.default.gc_thresh1\": {\"value\": {\"get_param\": \"NeighbourGcThreshold1\"}}, \"net.ipv4.neigh.default.gc_thresh2\": {\"value\": {\"get_param\": \"NeighbourGcThreshold2\"}}, \"net.ipv4.neigh.default.gc_thresh3\": {\"value\": {\"get_param\": \"NeighbourGcThreshold3\"}}, \"net.bridge.bridge-nf-call-arptables\": {\"value\": {\"get_param\": \"BridgeNfCallArpTables\"}}, \"net.bridge.bridge-nf-call-iptables\": {\"value\": {\"get_param\": \"BridgeNfCallIpTables\"}}, \"net.bridge.bridge-nf-call-ip6tables\": {\"value\": {\"get_param\": \"BridgeNfCallIp6Tables\"}}, \"fs.inotify.max_user_instances\": {\"value\": {\"if\": [\"is_inotify_intances_max_default\", {\"get_param\": \"InotifyInstancesMax\"}, {\"get_param\": \"InotifyIntancesMax\"}]}}}, {\"if\": [\"fs_aio_max_number_set\", {\"fs.aio-max-nr\": {\"value\": {\"get_param\": [\"RoleParameters\", \"FsAioMaxNumber\"]}}}]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"extra_sysctl_settings\"]}]}}}}}}", "file:///root/tripleo-heat-installer-templates/container_config_scripts/mysql_upgrade_db.sh": "#!/usr/bin/bash\n\nset -e\n\n# Wait until we know the mysql server is up and responding\ntimeout ${DB_MAX_TIMEOUT:-60} /bin/bash -c 'until mysqladmin -uroot ping 2>/dev/null; do sleep 1; done'\n\n# After an upgrade, make sure that the running mysql had a chance to\n# update its data table on disk.\nmysql_upgrade\n\n# Upgrade to 10.3: the default table row format changed from COMPACT\n# to DYNAMIC, so upgrade the existing tables.\ncompact_tables=$(mysql -se 'SELECT CONCAT(\"`\",TABLE_SCHEMA,\"`.`\",TABLE_NAME,\"`\") FROM information_schema.tables WHERE ENGINE = \"InnoDB\" and ROW_FORMAT = \"Compact\";');\nfor i in $compact_tables; do echo converting row format of table $i; mysql -e \"ALTER TABLE $i ROW_FORMAT=DYNAMIC;\"; done;\n", "file:///root/tripleo-heat-installer-templates/deployment/database/mysql-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"MySQL service deployment using puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"MysqlMaxConnections\": {\"description\": \"Configures MySQL max_connections config setting\", \"type\": \"number\", \"default\": 4096}, \"MysqlIncreaseFileLimit\": {\"description\": \"Flag to increase MySQL open-files-limit to 16384\", \"type\": \"boolean\", \"default\": true}, \"MysqlRootPassword\": {\"type\": \"string\", \"hidden\": true, \"default\": \"\"}, \"MysqlClustercheckPassword\": {\"type\": \"string\", \"hidden\": true}, \"EnableGalera\": {\"default\": true, \"description\": \"Whether to use Galera instead of regular MariaDB.\", \"type\": \"boolean\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"EnableMysqlAuthEd25519\": {\"type\": \"boolean\", \"description\": \"Whether to configure MySQL users to connect to the server using the Ed25519-based client authentication.\", \"default\": false}, \"MysqlIPv6\": {\"default\": false, \"description\": \"Enable IPv6 in MySQL\", \"type\": \"boolean\"}, \"MysqlInnodbBufferPoolSize\": {\"type\": \"string\", \"description\": \"Buffer pool size for MySQL database; this needs to be larger for at-scale deployments\", \"default\": \"1G\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"MysqlCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"MysqlIPv6\"]}], \"conditions\": {\"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}, 6]}, \"innodb_buffer_pool_set\": {\"not\": {\"equals\": [{\"get_param\": \"MysqlInnodbBufferPoolSize\"}, \"\"]}}, \"key_size_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"MysqlCertificateKeySize\"}, \"\"]}}}, \"outputs\": {\"container_config_scripts\": {\"description\": \"Shared docker config scripts\", \"value\": {\"mysql_upgrade_db.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/mysql_upgrade_db.sh\"}}}}, \"mysql_drop_unused_users\": {\"description\": \"Ansible block to clean up unusued Openstack DB users\", \"value\": [{\"name\": \"Drop unused OpenStack DB users\", \"when\": [\"step|int == 1\", \"mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower\"], \"block\": [{\"name\": \"mysql container id\", \"command\": \"podman ps -q --filter name={{ mysql_container_name }} --filter status=running\", \"register\": \"mysql_container_id\"}, {\"name\": \"set mysql container id fact\", \"set_fact\": {\"mysql_container\": \"{{ mysql_container_id.stdout }}\"}}, {\"name\": \"Mysql script to drop unused DB users\", \"when\": \"( mysql_container | length ) > 0\", \"block\": [{\"name\": \"Get the list of all OpenStack DB users\", \"shell\": \"jq -r 'to_entries[] | select(.key|endswith(\\\"::db::mysql::user\\\")) | .value' /etc/puppet/hieradata/service_configs.json\", \"register\": \"openstack_db_users\"}, {\"name\": \"List all DB users that match the DB users to be dropped\", \"shell\": \"for u in {{ openstack_db_users.stdout_lines | join(' ') }}; do podman exec -u root -it \\\"{{ mysql_container }}\\\" mysql -sNe \\\"select concat('\\\\`',user,'\\\\`@\\\\`',host,'\\\\`') from mysql.user where user = '$u' and host != '%';\\\"; done\", \"register\": \"mysql_db_users\"}, {\"name\": \"resulting DB users to be dropped\", \"debug\": {\"msg\": \"{{ mysql_db_users.stdout_lines }}\"}}, {\"name\": \"Drop all unneeded Openstack DB users\", \"shell\": \"podman exec -u root -it \\\"{{ mysql_container }}\\\" mysql -sNe 'drop user {{ item }};'\", \"loop\": \"{{ mysql_db_users.stdout_lines }}\"}]}]}]}, \"role_data\": {\"description\": \"Service MySQL using composable services.\", \"value\": {\"service_name\": \"mysql\", \"config_settings\": {\"mysql::server::package_name\": \"mariadb-galera-server\", \"mysql::server::manage_config_file\": true, \"mysql_ipv6\": {\"if\": [\"is_ipv6\", true, false]}, \"mysql_max_connections\": {\"get_param\": \"MysqlMaxConnections\"}, \"mysql::server::root_password\": {\"get_param\": \"MysqlRootPassword\"}, \"mysql_clustercheck_password\": {\"get_param\": \"MysqlClustercheckPassword\"}, \"enable_galera\": {\"get_param\": \"EnableGalera\"}, \"mysql_auth_ed25519\": {\"get_param\": \"EnableMysqlAuthEd25519\"}, \"mysql_bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::base::database::mysql::bind_address\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::base::database::mysql::client_bind_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::base::database::mysql::generate_dropin_file_limit\": {\"get_param\": \"MysqlIncreaseFileLimit\"}, \"tripleo::profile::base::database::mysql::certificate_specs\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"service_certificate\": \"/etc/pki/tls/certs/mysql.crt\", \"service_key\": \"/etc/pki/tls/private/mysql.key\"}]}, \"innodb_buffer_pool_size\": {\"if\": [\"innodb_buffer_pool_set\", {\"get_param\": \"MysqlInnodbBufferPoolSize\"}]}}, \"step_config\": \"include tripleo::profile::base::database::mysql\\n\", \"metadata_settings\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"service\": \"mysql\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}, \"type\": \"vip\"}, {\"service\": \"mysql\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}, \"type\": \"node\"}]]}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"mysql\", \"dns\": [{\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, {\"str_replace\": {\"template\": \"{{cloud_names.cloud_name_NETWORK}}\", \"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}], \"principal\": {\"str_replace\": {\"template\": \"mysql/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"key_size\": {\"if\": [\"key_size_override_set\", {\"get_param\": \"MysqlCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/database/mysql-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"MySQL service deployment with pacemaker bundle\\n\", \"parameters\": {\"ContainerMysqlImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerMysqlConfigImage\": {\"description\": \"The container image to use for the mysql config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"MysqlRootPassword\": {\"type\": \"string\", \"hidden\": true, \"default\": \"\"}, \"MysqlClustercheckPassword\": {\"type\": \"string\", \"hidden\": true}, \"MysqlUpgradePersist\": {\"type\": \"boolean\", \"default\": false}, \"MysqlUpgradeTransfer\": {\"type\": \"boolean\", \"default\": true}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"MysqlGaleraSSTMethod\": {\"type\": \"string\", \"default\": \"rsync\", \"description\": \"Method used by galera to perform State Snapshot Transfers\", \"constraints\": [{\"allowed_values\": [\"rsync\", \"mariabackup\"]}]}, \"MysqlMariabackupUser\": {\"type\": \"string\", \"default\": \"mariabackup\", \"description\": \"When MysqlGaleraSSTMethod is set to mariabackup, the name of the database user that executes the SST.\"}, \"MysqlMariabackupPassword\": {\"type\": \"string\", \"hidden\": true, \"description\": \"When MysqlGaleraSSTMethod is set to mariabackup, the password of the database user that executes the SST.\"}, \"MysqlGaleraSSLCipher\": {\"type\": \"string\", \"default\": \"AES128-SHA256\", \"description\": \"Symmetric cipher to use.\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MysqlBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerMysqlImage\": \"ContainerMysqlImage\", \"ContainerMysqlConfigImage\": \"ContainerMysqlConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerMysqlImage\": {\"get_param\": \"ContainerMysqlImage\"}, \"ContainerMysqlConfigImage\": {\"get_param\": \"ContainerMysqlConfigImage\"}}}]}}}}, \"conditions\": {\"docker_enabled\": {\"equals\": [{\"get_param\": \"ContainerCli\"}, \"docker\"]}}, \"outputs\": {\"role_data\": {\"description\": \"Containerized service MySQL using composable services.\", \"value\": {\"service_name\": {\"get_attr\": [\"MysqlBase\", \"role_data\", \"service_name\"]}, \"firewall_rules\": {\"104 mysql galera-bundle\": {\"dport\": [873, 3123, 3306, 4444, 4567, 4568, 9200]}}, \"firewall_frontend_rules\": {\"100 mysql_haproxy\": {\"dport\": [3306]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"MysqlBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::profile::pacemaker::database::mysql::bind_address\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::mysql::gmcast_listen_addr\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::mysql::ca_file\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo::profile::pacemaker::database::mysql_bundle::mysql_docker_image\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"tripleo::profile::pacemaker::database::mysql_bundle::control_port\": 3123, \"tripleo::profile::pacemaker::database::mysql_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::database::mysql_bundle::bind_address\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::mysql_bundle::ca_file\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"InternalTLSCAFile\"}]}, \"tripleo::profile::pacemaker::database::mysql_bundle::sst_method\": {\"get_param\": \"MysqlGaleraSSTMethod\"}, \"tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_user\": {\"get_param\": \"MysqlMariabackupUser\"}, \"tripleo::profile::pacemaker::database::mysql_bundle::mariabackup_password\": {\"get_param\": \"MysqlMariabackupPassword\"}, \"tripleo::profile::pacemaker::database::mysql_bundle::force_ocf\": true, \"tripleo::profile::pacemaker::database::mysql_bundle::gcomm_cipher\": {\"get_param\": \"MysqlGaleraSSLCipher\"}}]}, \"puppet_config\": {\"config_volume\": \"mysql\", \"puppet_tags\": \"file\", \"step_config\": {\"list_join\": [\"\\n\", [\"['Mysql_datadir', 'Mysql_user', 'Mysql_database', 'Mysql_grant', 'Mysql_plugin'].each |String $val| { noop_resource($val) }\", \"exec {'wait-for-settle': command => '/bin/true' }\", \"include tripleo::profile::pacemaker::database::mysql_bundle\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/mysql.json\": {\"command\": \"/usr/sbin/pacemaker_remoted\", \"config_files\": [{\"dest\": \"/etc/libqb/force-filesystem-sockets\", \"source\": \"/dev/null\", \"owner\": \"root\", \"perm\": \"0644\"}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"optional\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/mysql\", \"owner\": \"mysql:mysql\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/mysql.crt\", \"owner\": \"mysql:mysql\", \"perm\": \"0600\", \"optional\": true}, {\"path\": \"/etc/pki/tls/private/mysql.key\", \"owner\": \"mysql:mysql\", \"perm\": \"0600\", \"optional\": true}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_1\": {\"mysql_data_ownership\": {\"start_order\": 0, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"net\": \"host\", \"user\": \"root\", \"command\": [\"chown\", \"-R\", \"mysql:\", \"/var/lib/mysql\"], \"volumes\": [\"/var/lib/mysql:/var/lib/mysql:z\"]}, \"mysql_bootstrap\": {\"start_order\": 1, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"net\": \"host\", \"user\": \"root\", \"command\": [\"bash\", \"-ec\", {\"list_join\": [\"\\n\", [\"if [ -e /var/lib/mysql/mysql ]; then exit 0; fi\", \"echo -e \\\"\\\\n[mysqld]\\\\nwsrep_provider=none\\\" >> /etc/my.cnf\", \"export DB_ROOT_PASSWORD=$(hiera 'mysql::server::root_password')\", \"kolla_set_configs\", \"sudo -u mysql -E kolla_extend_start\", \"timeout ${DB_MAX_TIMEOUT} /bin/bash -c 'while pgrep -af /usr/bin/mysqld_safe | grep -q -v grep; do sleep 1; done'\", \"mysqld_safe --skip-networking --wsrep-on=OFF &\", \"timeout ${DB_MAX_TIMEOUT} /bin/bash -c 'until mysqladmin -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" ping 2>/dev/null; do sleep 1; done'\"], {\"if\": [{\"equals\": [{\"get_param\": \"MysqlGaleraSSTMethod\"}, \"mariabackup\"]}, [\"mysql -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" -e \\\"CREATE USER '${DB_MARIABACKUP_USER}'@'localhost' IDENTIFIED BY '${DB_MARIABACKUP_PASSWORD}';\\\"\", \"mysql -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" -e \\\"GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO '${DB_MARIABACKUP_USER}'@'localhost';\\\"\"]]}, [\"mysql -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" -e \\\"CREATE USER 'clustercheck'@'localhost' IDENTIFIED BY '$(hiera mysql_clustercheck_password)';\\\"\", \"mysql -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" -e \\\"GRANT PROCESS ON *.* TO 'clustercheck'@'localhost' WITH GRANT OPTION;\\\"\", \"mysql -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" -e \\\"DELETE FROM mysql.user WHERE user = 'root' AND host NOT IN ('%','localhost');\\\"\", \"timeout ${DB_MAX_TIMEOUT} mysqladmin -uroot -p\\\"$(hiera 'mysql::server::root_password')\\\" shutdown\"]]}], \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/mysql.json:/var/lib/kolla/config_files/config.json:rw,z\", \"/var/lib/config-data/puppet-generated/mysql:/var/lib/kolla/config_files/src:ro,z\", \"/var/lib/mysql:/var/lib/mysql:rw,z\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro\", \"/etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"KOLLA_BOOTSTRAP\": true, \"DB_MAX_TIMEOUT\": 60, \"DB_MARIABACKUP_USER\": {\"get_param\": \"MysqlMariabackupUser\"}, \"DB_MARIABACKUP_PASSWORD\": {\"get_param\": \"MysqlMariabackupPassword\"}}}}, \"step_2\": {\"mysql_wait_bundle\": {\"start_order\": 0, \"detach\": false, \"net\": \"host\", \"ipc\": \"host\", \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"2\", \"file,file_line,concat,augeas,galera_ready,mysql_database,mysql_grant,mysql_user\", \"include tripleo::profile::pacemaker::database::mysql_bundle\"], {\"if\": [{\"get_param\": \"ConfigDebug\"}, [\"--debug\"]]}]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/var/lib/mysql:/var/lib/mysql:rw,z\", \"/var/lib/config-data/puppet-generated/mysql/root:/root:rw\"], {\"if\": [\"docker_enabled\", [\"/etc/corosync/corosync.conf:/etc/corosync/corosync.conf:ro\"]]}]}, \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/mysql\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/mysql\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/log/mariadb\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"metadata_settings\": {\"get_attr\": [\"MysqlBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"MysqlBase\", \"role_data\", \"deploy_steps_tasks\"]}, [{\"name\": \"MySQL tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"container_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"MySQL HA Wrappers Step\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Mysql puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"mysql\", \"tripleo_ha_wrapper_resource_name\": \"galera\", \"tripleo_ha_wrapper_bundle_name\": \"galera-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Master\", \"tripleo_ha_wrapper_puppet_config_volume\": \"mysql\", \"tripleo_ha_wrapper_puppet_execute\": \"[\\\"Mysql_datadir\\\", \\\"Mysql_user\\\", \\\"Mysql_database\\\", \\\"Mysql_grant\\\", \\\"Mysql_plugin\\\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::database::mysql_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}]}]]}, \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get galera image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_galera_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='galera-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container galera image\", \"set_fact\": {\"galera_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"galera_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_galera_image\": \"{{xmllint_pcmk_galera_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"mysql\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"MySQL temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"mysql\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"galera-bundle\", \"tripleo_ha_image_update_new_image\": \"{{galera_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_galera_image}}\"}, \"when\": [\"(pcmk_galera_image != \\\"\\\")\", \"(pcmk_galera_image != galera_image_latest)\"]}]}], \"update_tasks\": [{\"block\": [{\"name\": \"Get galera image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_galera_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='galera-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container galera image\", \"set_fact\": {\"galera_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"galera_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_galera_image\": \"{{xmllint_pcmk_galera_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of galera container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_galera_image == galera_image_latest\", \"fail_msg\": \"galera image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"Tear-down non-HA mysql container\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"stat mysql container\", \"command\": \"podman container exists mysql\", \"failed_when\": false, \"changed_when\": false, \"register\": \"stat_mysql_container\"}, {\"name\": \"Create clustercheck user and permissions\", \"command\": {\"argv\": \"{{ mysql_exec_data | container_exec_cmd }}\"}, \"changed_when\": true, \"when\": [\"stat_mysql_container.rc == 0\"], \"vars\": {\"mysql_exec_data\": {\"environment\": {\"CLUSTERCHECK_PASSWORD\": {\"get_param\": \"MysqlClustercheckPassword\"}}, \"command\": [\"mysql\", \"/bin/sh\", \"-c\", \"mysql -e \\\"CREATE USER IF NOT EXISTS 'clustercheck'@'localhost' IDENTIFIED BY '${CLUSTERCHECK_PASSWORD}'; GRANT PROCESS ON *.* TO 'clustercheck'@'localhost' WITH GRANT OPTION;\\\"\"]}}}, {\"name\": \"Remove non-HA mysql container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"mysql\"]}}]}, {\"name\": \"Mariadb fetch and retag container image for pacemaker\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Retag pcmklatest to latest galera image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{galera_image}}\", \"container_image_latest\": \"{{galera_image_latest}}\"}}]}, {\"name\": \"Ensure mariadb-server is not installed on the host\", \"when\": \"step|int == 2\", \"yum\": {\"name\": \"mariadb-server*\", \"state\": \"absent\"}}], \"post_update_tasks\": [{\"name\": \"Mysql bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Mysql puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"mysql\", \"tripleo_ha_wrapper_resource_name\": \"galera\", \"tripleo_ha_wrapper_bundle_name\": \"galera-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Master\", \"tripleo_ha_wrapper_puppet_config_volume\": \"mysql\", \"tripleo_ha_wrapper_puppet_execute\": \"[\\\"Mysql_datadir\\\", \\\"Mysql_user\\\", \\\"Mysql_database\\\", \\\"Mysql_grant\\\", \\\"Mysql_plugin\\\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::database::mysql_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}], \"upgrade_tasks\": {\"list_concat\": [[{\"name\": \"Tear-down non-HA mysql container\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"stat mysql container\", \"command\": \"podman container exists mysql\", \"failed_when\": false, \"changed_when\": false, \"register\": \"stat_mysql_container\"}, {\"name\": \"Create clustercheck user and permissions\", \"command\": {\"argv\": \"{{ mysql_exec_data | container_exec_cmd }}\"}, \"changed_when\": true, \"when\": [\"stat_mysql_container.rc == 0\"], \"vars\": {\"mysql_exec_data\": {\"environment\": {\"CLUSTERCHECK_PASSWORD\": {\"get_param\": \"MysqlClustercheckPassword\"}}, \"command\": [\"mysql\", \"/bin/sh\", \"-c\", \"mysql -e \\\"CREATE USER IF NOT EXISTS 'clustercheck'@'localhost' IDENTIFIED BY '${CLUSTERCHECK_PASSWORD}'; GRANT PROCESS ON *.* TO 'clustercheck'@'localhost' WITH GRANT OPTION;\\\"\"]}}}, {\"name\": \"Remove non-HA mysql container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"mysql\"]}}]}], [{\"name\": \"set mysql container name fact\", \"when\": [\"step|int == 1\"], \"set_fact\": {\"mysql_container_name\": \"galera-bundle\"}}], {\"get_attr\": [\"MysqlBase\", \"mysql_drop_unused_users\"]}, [{\"vars\": {\"mysql_upgrade_persist\": {\"get_param\": \"MysqlUpgradePersist\"}}, \"when\": [\"step|int == 3\", \"mysql_upgrade_persist\"], \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_prepare\"], \"block\": [{\"name\": \"Persist mysql data\", \"include_role\": {\"name\": \"tripleo_persist\", \"tasks_from\": \"persist.yml\"}, \"vars\": {\"tripleo_persist_dir\": \"/var/lib/mysql\"}}]}, {\"vars\": {\"mysql_upgrade_persist\": {\"get_param\": \"MysqlUpgradePersist\"}}, \"when\": [\"step|int == 5\", \"mysql_upgrade_persist\"], \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\"], \"block\": [{\"name\": \"Restore mysql data\", \"include_role\": {\"name\": \"tripleo_persist\", \"tasks_from\": \"restore.yml\"}, \"vars\": {\"tripleo_persist_dir\": \"/var/lib/mysql\"}}]}, {\"name\": \"Prepare switch of galera image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get galera image id currently used by pacemaker\", \"shell\": \"pcs resource config galera-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"galera_image_current_res\", \"failed_when\": false}, {\"name\": \"Image facts for galera\", \"set_fact\": {\"galera_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"galera_image_current\": \"{{galera_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current galera image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{galera_image_current}}\", \"container_image_latest\": \"{{galera_image_latest}}\", \"pull_image\": false}, \"when\": [\"galera_image_current != ''\", \"galera_image_current != galera_image_latest\"]}, {\"name\": \"Create galera retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/galera_needs_retag\", \"state\": \"touch\"}, \"when\": [\"galera_image_current != ''\", \"galera_image_current != galera_image_latest\"]}]}, {\"name\": \"Update galera pcs resource bundle for new container image - check\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"set is_mysql_bootstrap_node fact\", \"tags\": \"common\", \"set_fact\": \"is_mysql_bootstrap_node={{mysql_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}, {\"name\": \"Check for galera retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/galera_needs_retag\"}, \"register\": \"galera_retag_state_file\"}]}, {\"name\": \"Update galera pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_mysql_bootstrap_node|bool\", \"galera_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the galera cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"galera-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Move Mysql logging to /var/log/containers\", \"block\": [{\"name\": \"Check Mysql logging configuration in pacemaker\", \"command\": \"cibadmin --query --xpath \\\"//storage-mapping[@id='mysql-log']\\\"\", \"failed_when\": false, \"register\": \"mysql_logs_moved\"}, {\"name\": \"Change Mysql logging configuration in pacemaker\", \"when\": \"mysql_logs_moved.rc == 6\", \"block\": [{\"name\": \"Add a bind mount for logging in the galera bundle\", \"command\": \"pcs resource bundle update galera-bundle storage-map add id=mysql-log source-dir=/var/log/containers/mysql target-dir=/var/log/mysql options=rw\"}, {\"name\": \"Reconfigure Mysql log file in the galera resource agent\", \"command\": \"pcs resource update galera log=/var/log/mysql/mysqld.log\"}]}]}, {\"name\": \"Update the galera bundle to use the new container image name\", \"command\": \"pcs resource bundle update galera-bundle container image={{galera_image_latest}}\"}, {\"name\": \"Enable the galera cluster resource\", \"pacemaker_resource\": {\"resource\": \"galera-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}, {\"name\": \"Upgrade galera in step3\", \"when\": [\"step|int == 3\"], \"block\": [{\"name\": \"Bind mounts for temporary container\", \"set_fact\": {\"mysql_upgrade_db_bind_mounts\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/mysql.json:/var/lib/kolla/config_files/config.json:rw,z\", \"/var/lib/config-data/puppet-generated/mysql:/var/lib/kolla/config_files/src:ro,z\", \"/var/lib/mysql:/var/lib/mysql:rw,z\"], [\"/var/log/containers/mysql:/var/log/mysql:rw,z\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/mysql.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/mysql.crt:ro\", \"/etc/pki/tls/private/mysql.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/mysql.key:ro\"]]}]}}}, {\"name\": \"Check if Galera needs upgrade\", \"shell\": {\"str_replace\": {\"template\": \"CONTAINER_CLI run --rm --log-driver=k8s-file --log-opt path=LOG_DIR/db-upgrade.log \\\\ -u root --net=host UPGRADE_ENV UPGRADE_VOLUMES \\\"UPGRADE_IMAGE\\\" /bin/bash -ecx \\\"$UPGRADE_SCRIPT\\\"\", \"params\": {\"UPGRADE_ENV\": \"-e \\\"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\\\"\", \"UPGRADE_IMAGE\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"UPGRADE_VOLUMES\": \"-v {{ mysql_upgrade_db_bind_mounts | join(' -v ')}}\", \"CONTAINER_CLI\": \"{{ container_cli }}\", \"LOG_DIR\": \"/var/log/containers/mysql\"}}}, \"environment\": {\"UPGRADE_SCRIPT\": \"kolla_set_configs\\nupgraded_ver=$(cat /var/lib/mysql/mysql_upgrade_info 2>/dev/null || true)\\nmysql_ver=$(mysql --version | awk -F'[ ,]*' '{print $5}')\\nif [ \\\"${upgraded_ver}\\\" = \\\"${mysql_ver}\\\" ]; then\\n    echo \\\"mysql already upgraded\\\"\\nelse\\n    echo \\\"${upgraded_ver} VS ${mysql_ver}\\\"\\nfi\\n\"}, \"register\": \"mysql_upgrade_needed\"}, {\"name\": \"Set fact upgrade_mysql\", \"set_fact\": {\"upgrade_mysql\": \"{{ (mysql_upgrade_needed.stdout != \\\"mysql already upgraded\\\") | bool }}\"}}, {\"debug\": {\"msg\": \"MYSQL check - {{ mysql_upgrade_needed.stdout }} - Upgrade needed: {{ upgrade_mysql }}\"}}, {\"name\": \"Disable the galera cluster resource before container upgrade\", \"when\": [\"upgrade_mysql|bool\"], \"pacemaker_resource\": {\"resource\": \"galera-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"block\": [{\"name\": \"Get galera image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_galera_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='galera-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container galera image\", \"set_fact\": {\"galera_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"galera_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_galera_image\": \"{{xmllint_pcmk_galera_image.stdout}}\"}}]}, {\"name\": \"Check for galera retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/galera_needs_retag\"}, \"register\": \"galera_retag_state_file\"}, {\"name\": \"Retag the pacemaker image if containerized\", \"when\": [\"galera_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Retag pcmklatest to latest galera image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{galera_image}}\", \"container_image_latest\": \"{{galera_image_latest}}\"}}]}, {\"name\": \"Remove galera retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/galera_needs_retag\", \"state\": \"absent\"}}, {\"name\": \"Mysql upgrade script\", \"when\": [\"upgrade_mysql|bool\"], \"set_fact\": {\"mysql_upgrade_script\": {\"list_join\": [\"\\n\", [\"kolla_set_configs\\nif mysqladmin ping --silent; then exit 0; fi\\nupgraded_ver=$(cat /var/lib/mysql/mysql_upgrade_info 2>/dev/null || true)\\nmysql_ver=$(mysql --version | awk -F'[ ,]*' '{print $5}')\\nif [ \\\"${upgraded_ver}\\\" = \\\"${mysql_ver}\\\" ]; then\\n    echo \\\"mysql already upgraded\\\"\\n    exit 0\\nfi\\nchown -R mysql:mysql /var/lib/mysql\\nchown -R mysql:mysql /var/log/mysql\\nmysqld_safe --user=mysql --wsrep-provider=none --skip-networking --wsrep-on=off --log-error=/var/log/mysql/mysqld-upgrade.log &\\n\", {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/mysql_upgrade_db.sh\"}, \"mysqladmin shutdown\"]]}}}, {\"name\": \"Upgrade Mysql database from a temporary container\", \"when\": [\"upgrade_mysql|bool\"], \"shell\": {\"str_replace\": {\"template\": \"CONTAINER_CLI run --rm --log-driver=k8s-file --log-opt path=LOG_DIR/db-upgrade.log \\\\ -u root --net=host UPGRADE_ENV UPGRADE_VOLUMES \\\"UPGRADE_IMAGE\\\" /bin/bash -ecx \\\"$UPGRADE_SCRIPT\\\"\", \"params\": {\"UPGRADE_ENV\": \"-e \\\"KOLLA_CONFIG_STRATEGY=COPY_ALWAYS\\\"\", \"UPGRADE_IMAGE\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/mariadb:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMysqlImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"UPGRADE_VOLUMES\": \"-v {{ mysql_upgrade_db_bind_mounts | join(' -v ')}}\", \"CONTAINER_CLI\": \"{{ container_cli }}\", \"LOG_DIR\": \"/var/log/containers/mysql\"}}}, \"environment\": {\"UPGRADE_SCRIPT\": \"{{ mysql_upgrade_script }}\"}}, {\"name\": \"Enable the galera cluster resource\", \"when\": [\"upgrade_mysql|bool\"], \"pacemaker_resource\": {\"resource\": \"galera-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}]]}, \"external_upgrade_tasks\": [{\"vars\": {\"mysql_upgrade_transfer\": {\"get_param\": \"MysqlUpgradeTransfer\"}}, \"when\": [\"step|int == 2\", \"mysql_upgrade_transfer\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\"], \"block\": [{\"name\": \"Transfer mysql data\", \"include_role\": {\"name\": \"tripleo_transfer\"}, \"vars\": {\"tripleo_transfer_src_dir\": \"/var/lib/mysql\", \"tripleo_transfer_src_host\": \"{{hostvars[groups['overcloud'][0]]['mysql_short_node_names'][1]}}\", \"tripleo_transfer_dest_dir\": \"/var/lib/mysql\", \"tripleo_transfer_dest_host\": \"{{hostvars[groups['overcloud'][0]]['mysql_short_bootstrap_node_name']}}\", \"tripleo_transfer_flag_file\": \"/var/lib/tripleo/transfer-flags/var-lib-mysql\", \"tripleo_transfer_sync_options\": \"--whole-file --ignore-times --inplace --archive --delete\", \"tripleo_transfer_include\": [\"/ibdata*\", \"/ib_lru_dump\", \"/ib_logfile[0-9]*\", \"/undo*\", \"/*/\"], \"tripleo_transfer_exclude\": \"/*\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron base service. Shared for all Neutron agents.\\n\", \"parameters\": {\"DatabaseSyncTimeout\": {\"default\": 300, \"description\": \"DB Sync Timeout default\", \"type\": \"number\"}, \"NeutronDhcpAgentsPerNetwork\": {\"type\": \"number\", \"default\": 0, \"description\": \"The number of neutron dhcp agents to schedule per network\"}, \"DhcpAgentNotification\": {\"default\": false, \"description\": \"Whether or not to enable DHCP agent notifications.\", \"type\": \"boolean\"}, \"NeutronDnsDomain\": {\"type\": \"string\", \"default\": \"openstacklocal\", \"description\": \"Domain to use for building the hostnames.\"}, \"NeutronCorePlugin\": {\"default\": \"ml2\", \"description\": \"The core plugin for Neutron. The value should be the entrypoint to be loaded\\nfrom neutron.core_plugins namespace.\\n\", \"type\": \"string\"}, \"NeutronServicePlugins\": {\"default\": \"qos,ovn-router,trunk,segments,port_forwarding,log\", \"description\": \"Comma-separated list of service plugin entrypoints to be loaded from the\\nneutron.service_plugins namespace.\\n\", \"type\": \"comma_delimited_list\"}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"NeutronDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Neutron services.\", \"type\": \"boolean\"}, \"EnableConfigPurge\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Remove configuration that is not generated by TripleO. Used to avoid configuration remnants after upgrades.\\n\"}, \"NeutronGlobalPhysnetMtu\": {\"type\": \"number\", \"default\": 0, \"description\": \"MTU of the underlying physical network. Neutron uses this value to\\ncalculate MTU for all virtual network components. For flat and VLAN\\nnetworks, neutron uses this value without modification. For overlay\\nnetworks such as VXLAN, neutron automatically subtracts the overlay\\nprotocol overhead from this value.\\n(If this is not changed TenantNetPhysnetMtu will be used.)\\n\"}, \"TenantNetPhysnetMtu\": {\"type\": \"number\", \"default\": 1500, \"description\": \"MTU of the underlying physical network. Neutron uses this value to\\ncalculate MTU for all virtual network components. For flat and VLAN\\nnetworks, neutron uses this value without modification. For overlay\\nnetworks such as VXLAN, neutron automatically subtracts the overlay\\nprotocol overhead from this value.\\n(The mtu setting of the Tenant network in network_data.yaml\\ncontrol's this parameter.)\\n\"}, \"NeutronDBSyncExtraParams\": {\"default\": \"\", \"description\": \"String of extra command line parameters to append to the neutron-db-manage\\nupgrade head command.\\n\", \"type\": \"string\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"EnableVLANTransparency\": {\"default\": false, \"description\": \"If True, then allow plugins that support it to create VLAN transparent networks.\\n\", \"type\": \"boolean\"}, \"NeutronGlobalReportInterval\": {\"default\": 300, \"description\": \"Seconds between nodes reporting state to server; should be less than NeutronAgentDownTime, best if it is half or less than NeutronAgentDownTime.\\n\", \"type\": \"number\"}}, \"conditions\": {\"dhcp_agents_zero\": {\"equals\": [{\"get_param\": \"NeutronDhcpAgentsPerNetwork\"}, 0]}, \"global_physnet_mtu_unset\": {\"equals\": [{\"get_param\": \"NeutronGlobalPhysnetMtu\"}, 0]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron base service.\", \"value\": {\"service_name\": \"neutron_base\", \"config_settings\": {\"map_merge\": [{\"neutron::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"neutron::core_plugin\": {\"get_param\": \"NeutronCorePlugin\"}, \"neutron::service_plugins\": {\"get_param\": \"NeutronServicePlugins\"}, \"neutron::report_interval\": {\"get_param\": \"NeutronGlobalReportInterval\"}, \"neutron::logging::debug\": {\"if\": [{\"get_param\": \"NeutronDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"neutron::purge_config\": {\"get_param\": \"EnableConfigPurge\"}, \"neutron::allow_overlapping_ips\": true, \"neutron::dhcp_agent_notification\": {\"get_param\": \"DhcpAgentNotification\"}, \"neutron::dns_domain\": {\"get_param\": \"NeutronDnsDomain\"}, \"neutron::rabbit_heartbeat_timeout_threshold\": 60, \"neutron::host\": \"%{hiera('fqdn_canonical')}\", \"neutron::db::database_db_max_retries\": -1, \"neutron::db::database_max_retries\": -1, \"neutron::db::sync::db_sync_timeout\": {\"get_param\": \"DatabaseSyncTimeout\"}, \"neutron::global_physnet_mtu\": {\"if\": [\"global_physnet_mtu_unset\", {\"get_param\": \"TenantNetPhysnetMtu\"}, {\"get_param\": \"NeutronGlobalPhysnetMtu\"}]}, \"neutron::db::sync::extra_params\": {\"get_param\": \"NeutronDBSyncExtraParams\"}, \"neutron::vlan_transparent\": {\"get_param\": \"EnableVLANTransparency\"}, \"neutron::rabbit_heartbeat_in_pthread\": false}, {\"if\": [\"dhcp_agents_zero\", {}, {\"tripleo::profile::base::neutron::dhcp_agents_per_network\": {\"get_param\": \"NeutronDhcpAgentsPerNetwork\"}}]}]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/kill-script": "#!/bin/bash\n{% if debug_enabled|bool -%}\nset -x\n{% endif -%}\nadd_date() {\n  echo \"$(date) $@\"\n}\n\n# Set up script logging for debugging purpose.\n# It will be taken care of by logrotate since there is the .log\n# suffix.\nexec 3>&1 4>&2\ntrap 'exec 2>&4 1>&3' 0 1 2 3\nexec 1>>/var/log/neutron/kill-script.log 2>&1\n\nSIG=$1\nPID=$2\nNETNS=$(ip netns identify ${PID})\n\nif [ \"x${NETNS}\" == \"x\" ]; then\n  CLI=\"nsenter --all --preserve-credentials -t 1 podman\"\n  SIG=9\nelse\n  CLI=\"nsenter --net=/run/netns/${NETNS} --preserve-credentials -m -t 1 podman\"\nfi\n\nkill_container() {\n  add_date \"Killing container $1 ($2)\"\n  signal_container $1 $2 9\n}\n\nstop_container() {\n  add_date \"Stopping container $1 ($2)\"\n  $CLI stop $2\n}\n\nsignal_container() {\n  SIGNAL=$3\n  if [ -z \"$SIGNAL\" ]; then\n      SIGNAL=\"HUP\"\n  fi\n  add_date \"Sending signal '$SIGNAL' to $1 ($2)\"\n  $CLI kill --signal $SIGNAL $2\n}\n\ndelete_container() {\n  add_date \"Deleting container $1 ($2)\"\n  $CLI rm $2 || echo \"Deleting container $1 ($2) failed\"\n}\n\n\n{% raw -%}\nif [ -f /proc/$PID/cgroup ]; then\n  # Get container ID based on process cgroups\n  CT_ID=$(awk 'BEGIN {FS=\".scope|-\"} /\\/libpod-/ {if ($(NF-1)) print $(NF-1);exit}' /proc/$PID/cgroup)\n  CT_NAME=$($CLI inspect -f '{{.Name}}' $CT_ID)\n\n  case $SIG in\n    HUP)\n      signal_container $CT_NAME $CT_ID\n      ;;\n    9)\n      kill_container $CT_NAME $CT_ID\n      delete_container $CT_NAME $CT_ID\n      ;;\n    15)\n      stop_container $CT_NAME $CT_ID\n      delete_container $CT_NAME $CT_ID\n      ;;\n    *)\n      add_date \"Unknown action ${SIG} for ${CT_NAME} ${CT_ID}\"\n      exit 1\n      ;;\n  esac\n\nelse\n  add_date \"No such PID: ${PID}\"\n  exit 1\nfi\n{% endraw %}\n", "file:///root/tripleo-heat-installer-templates/deployment/ovn/ovn-metadata-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized OVN Metadata agent\\n\", \"parameters\": {\"ContainerOvnMetadataImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"OvnMetadataAgentLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.neutron.agent.ovn-metadata\", \"file\": \"/var/log/containers/neutron/networking-ovn-metadata-agent.log\"}}, \"OVNEnableHaproxyDockerWrapper\": {\"description\": \"Generate a wrapper script so that haproxy is launched in a separate container.\", \"type\": \"boolean\", \"default\": true}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"OVNWrapperDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Controls debugging for the wrapper scripts.\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"NeutronMetadataProxySharedSecret\": {\"description\": \"Shared secret to prevent spoofing\", \"type\": \"string\", \"hidden\": true}, \"NeutronMetadataWorkers\": {\"default\": \"\", \"description\": \"Sets the number of worker processes for the neutron OVN metadata agent.\\nThe default value results in the configuration being left unset and a\\nsystem-dependent default will be chosen (usually the number of\\nprocessors). Please note that this can result in a large number of\\nprocesses and memory consumption on systems with a large core count. On\\nsuch systems it is recommended that a non-default value be selected that\\nmatches the load requirements.\\n\", \"type\": \"string\"}, \"NeutronPassword\": {\"description\": \"The password for the neutron service and db account, used by neutron agents.\", \"type\": \"string\", \"hidden\": true}, \"OVNNorthboundServerPort\": {\"description\": \"Port of the OVN Northbound DB server\", \"type\": \"number\", \"default\": 6641}, \"OVNSouthboundServerPort\": {\"description\": \"Port of the OVN Southbound DB server\", \"type\": \"number\", \"default\": 6642}, \"OVNDbConnectionTimeout\": {\"description\": \"Timeout in seconds for the OVSDB connection transaction\", \"type\": \"number\", \"default\": 180}, \"OVNOvsdbProbeInterval\": {\"description\": \"Probe interval in ms for the OVSDB session\", \"type\": \"number\", \"default\": 60000}, \"MonitoringSubscriptionOvnMetadata\": {\"default\": \"overcloud-ovn-metadata\", \"type\": \"string\"}, \"OvnMetadataAgentDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging for OVN Metadata agent.\", \"type\": \"boolean\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"DockerAdditionalSockets\": {\"default\": [\"/var/lib/openstack/docker.sock\"], \"description\": \"Additional domain sockets for the docker daemon to bind to (useful for mounting into containers that launch other containers)\", \"type\": \"comma_delimited_list\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"OvnMetadataCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"OvnHardwareOffloadedQos\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Enable the QoS support for hardware offloaded ports\"}, \"OVNMetadataImageUpdateTimeout\": {\"description\": \"During update, how long we wait for the container image to be updated, in seconds.\\n\", \"type\": \"number\", \"default\": 600}, \"OVNMetadataUpdateTimeout\": {\"description\": \"During update, how long we wait for the container to be updated, in seconds.\\n\", \"type\": \"number\", \"default\": 600}}, \"conditions\": {\"haproxy_wrapper_enabled\": {\"equals\": [{\"get_param\": \"OVNEnableHaproxyDockerWrapper\"}, true]}, \"docker_enabled\": {\"equals\": [{\"get_param\": \"ContainerCli\"}, \"docker\"]}, \"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"neutron_metadata_workers_unset\": {\"equals\": [{\"get_param\": \"NeutronMetadataWorkers\"}, \"\"]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"OvnMetadataCertificateKeySize\"}, \"\"]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"NeutronBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NeutronLogging\": {\"type\": \"OS::TripleO::Services::Logging::NeutronCommon\", \"properties\": {\"NeutronServiceName\": \"ovn-metadata-agent\"}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerOvnMetadataImage\": \"ContainerOvnMetadataImage\", \"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerOvnMetadataImage\": {\"get_param\": \"ContainerOvnMetadataImage\"}, \"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for OVNMetadata agent\", \"value\": {\"service_name\": \"ovn_metadata\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionOvnMetadata\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NeutronLogging\", \"config_settings\"]}, {\"tripleo::profile::base::neutron::ovn_metadata_agent_wrappers::enable_haproxy_wrapper\": {\"get_param\": \"OVNEnableHaproxyDockerWrapper\"}, \"tripleo::profile::base::neutron::ovn_metadata_agent_wrappers::haproxy_process_wrapper\": \"/var/lib/neutron/ovn_metadata_haproxy_wrapper\", \"tripleo::profile::base::neutron::ovn_metadata_agent_wrappers::haproxy_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnMetadataImage\"]}, \"tripleo::profile::base::neutron::ovn_metadata_agent_wrappers::debug\": {\"if\": [{\"get_param\": \"OVNWrapperDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"tripleo::profile::base::neutron::container_cli\": {\"get_param\": \"ContainerCli\"}, \"neutron::agents::ovn_metadata::shared_secret\": {\"get_param\": \"NeutronMetadataProxySharedSecret\"}, \"neutron::agents::ovn_metadata::auth_password\": {\"get_param\": \"NeutronPassword\"}, \"neutron::agents::ovn_metadata::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"neutron::agents::ovn_metadata::auth_tenant\": \"service\", \"neutron::agents::ovn_metadata::metadata_host\": {\"get_param\": [\"EndpointMap\", \"NovaMetadataCellInternal\", \"host_nobrackets\"]}, \"neutron::agents::ovn_metadata::ovsdb_connection_timeout\": {\"get_param\": \"OVNDbConnectionTimeout\"}, \"neutron::agents::ovn_metadata::ovsdb_probe_interval\": {\"get_param\": \"OVNOvsdbProbeInterval\"}, \"neutron::agents::ovn_metadata::hwol_qos_enabled\": {\"get_param\": \"OvnHardwareOffloadedQos\"}, \"ovn::northbound::port\": {\"get_param\": \"OVNNorthboundServerPort\"}, \"ovn::southbound::port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"neutron::agents::ovn_metadata::debug\": {\"if\": [{\"get_param\": \"OvnMetadataAgentDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"neutron::agents::ovn_metadata::metadata_protocol\": {\"if\": [\"internal_tls_enabled\", \"https\", \"http\"]}}, {\"if\": [\"neutron_metadata_workers_unset\", {}, {\"neutron::agents::ovn_metadata::metadata_workers\": {\"get_param\": \"NeutronMetadataWorkers\"}}]}, {\"if\": [\"internal_tls_enabled\", {\"tripleo::profile::base::neutron::ovn_metadata::ovn_nb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo::profile::base::neutron::ovn_metadata::ovn_sb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo::profile::base::neutron::ovn_metadata::protocol\": \"ssl\", \"tripleo::profile::base::neutron::ovn_metadata::ovn_nb_certificate\": \"/etc/pki/tls/certs/ovn_metadata.crt\", \"tripleo::profile::base::neutron::ovn_metadata::ovn_nb_private_key\": \"/etc/pki/tls/private/ovn_metadata.key\", \"tripleo::profile::base::neutron::ovn_metadata::ovn_sb_certificate\": \"/etc/pki/tls/certs/ovn_metadata.crt\", \"tripleo::profile::base::neutron::ovn_metadata::ovn_sb_private_key\": \"/etc/pki/tls/private/ovn_metadata.key\"}, {}]}]}, \"puppet_config\": {\"puppet_tags\": \"neutron_config,ovn_metadata_agent_config\", \"config_volume\": \"neutron\", \"step_config\": \"include tripleo::profile::base::neutron::ovn_metadata\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}, \"volumes\": [\"/lib/modules:/lib/modules:ro\", \"/run/openvswitch:/run/openvswitch:shared,z\"]}, \"kolla_config\": {\"/var/lib/kolla/config_files/ovn_metadata_agent.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/networking-ovn-metadata-agent --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/networking-ovn/networking-ovn-metadata-agent.ini\", {\"get_attr\": [\"NeutronLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}, {\"path\": \"/var/lib/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/ovn_metadata.crt\", \"owner\": \"neutron:neutron\", \"optional\": true, \"perm\": \"0644\"}, {\"path\": \"/etc/pki/tls/private/ovn_metadata.key\", \"owner\": \"neutron:neutron\", \"optional\": true, \"perm\": \"0644\"}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_2\": {\"create_haproxy_wrapper\": {\"start_order\": 1, \"detach\": false, \"net\": \"host\", \"pid\": \"host\", \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"4\", \"file\", \"include ::tripleo::profile::base::neutron::ovn_metadata_agent_wrappers\"]]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnMetadataImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/run/openvswitch:/run/openvswitch:shared,z\", \"/var/lib/neutron:/var/lib/neutron:shared,z\"]]}}}, \"step_4\": {\"setup_ovs_manager\": {\"start_order\": 0, \"detach\": false, \"net\": \"host\", \"privileged\": true, \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"4\", \"exec\", \"include tripleo::profile::base::neutron::ovn_metadata\"]]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnMetadataImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/lib/modules:/lib/modules:ro\", \"/run/openvswitch:/run/openvswitch:shared,z\"]]}, \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"ovn_metadata_agent\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnMetadataImage\"]}, \"net\": \"host\", \"pid\": \"host\", \"cgroupns\": \"host\", \"privileged\": true, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NeutronLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ovn_metadata_agent.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro\", \"/lib/modules:/lib/modules:ro\", \"/run/openvswitch:/run/openvswitch:shared,z\", \"/var/lib/neutron:/var/lib/neutron:shared,z\", \"/run/netns:/run/netns:shared\", \"/var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z\"], {\"if\": [\"docker_enabled\", [\"/var/lib/openstack:/var/lib/openstack\"], null]}, {\"if\": [\"haproxy_wrapper_enabled\", [\"/var/lib/neutron/ovn_metadata_haproxy_wrapper:/usr/local/bin/haproxy:ro\"], null]}, {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/ovn_metadata.crt:/etc/pki/tls/certs/ovn_metadata.crt\", \"/etc/pki/tls/private/ovn_metadata.key:/etc/pki/tls/private/ovn_metadata.key\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"list_concat\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"metadata_settings\"]}, {\"if\": [\"internal_tls_enabled\", [{\"service\": \"ovn_metadata\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"type\": \"node\"}], null]}]}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"ovn_metadata\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"ovn_metadata/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"OvnMetadataCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NeutronLogging\", \"host_prep_tasks\"]}, [{\"name\": \"create /run/netns with temp namespace\", \"command\": \"ip netns add ns_temp\", \"register\": \"ipnetns_add_result\", \"failed_when\": false}, {\"name\": \"remove temp namespace\", \"command\": \"ip netns delete ns_temp\", \"failed_when\": false, \"when\": [\"ipnetns_add_result.rc is defined\", \"ipnetns_add_result.rc == 0\"]}, {\"name\": \"create /var/lib/neutron\", \"file\": {\"path\": \"/var/lib/neutron\", \"state\": \"directory\", \"setype\": \"container_file_t\"}}, {\"name\": \"set conditions\", \"set_fact\": {\"haproxy_wrapper_enabled\": {\"get_param\": \"OVNEnableHaproxyDockerWrapper\"}, \"debug_enabled\": {\"if\": [{\"get_param\": \"OVNWrapperDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"docker_additional_sockets\": {\"get_param\": \"DockerAdditionalSockets\"}}}, {\"name\": \"create kill_scripts directory within /var/lib/neutron\", \"file\": {\"state\": \"directory\", \"path\": \"/var/lib/neutron/kill_scripts\"}}, {\"name\": \"create haproxy kill script\", \"when\": \"haproxy_wrapper_enabled|bool\", \"copy\": {\"dest\": \"/var/lib/neutron/kill_scripts/haproxy-kill\", \"mode\": 493, \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/kill-script\"}}}]]}, \"upgrade_tasks\": [], \"external_update_tasks\": [{\"name\": \"Check if python3-openvswitch3.1 workaround is needed\", \"delegate_to\": \"{{ item }}\", \"become\": true, \"tags\": [\"ovn\", \"ovn_image\"], \"when\": \"step|int == 1\", \"shell\": \"if podman exec ovn_metadata_agent rpm -q python3-openvswitch3.1 > /dev/null ; then echo REQUIRED; else echo OK ; fi\\n\", \"register\": \"metadata_python_ovs_3_1\", \"failed_when\": false, \"loop\": \"{{ groups['ovn_metadata'] | difference(groups['excluded_overcloud']) }}\"}, {\"name\": \"Update ovn_metadata_agents\", \"vars\": {\"hosts_to_update_metadata\": \"{{ metadata_python_ovs_3_1.results | selectattr('stdout', 'eq', 'REQUIRED') | map(attribute='item') | list }}\"}, \"tags\": [\"ovn\", \"ovn_image\"], \"when\": [\"step|int == 1\", \"hosts_to_update_metadata | length > 0\"], \"block\": [{\"name\": \"Force pull image in case image name doesn't change.\", \"become\": true, \"loop\": \"{{ hosts_to_update_metadata }}\", \"delegate_to\": \"{{ item }}\", \"async\": {\"get_param\": \"OVNMetadataImageUpdateTimeout\"}, \"poll\": 0, \"register\": \"ovn_metadata_image_update\", \"containers.podman.podman_image\": {\"name\": {\"get_param\": \"ContainerOvnMetadataImage\"}, \"validate_certs\": false, \"force\": true}}, {\"name\": \"Was the ovn_metadata_agent image pull successful.\", \"when\": [\"'results' in ovn_metadata_image_update\"], \"become\": true, \"delegate_to\": \"{{ async_result_item.item }}\", \"async_status\": {\"jid\": \"{{ async_result_item.ansible_job_id }}\"}, \"loop\": \"{{ovn_metadata_image_update.results }}\", \"loop_control\": {\"loop_var\": \"async_result_item\"}, \"register\": \"async_poll_results\", \"until\": \"async_poll_results.finished\", \"retries\": {\"get_param\": \"OVNMetadataImageUpdateTimeout\"}, \"delay\": 1}, {\"name\": \"Now rotate all ovn_metadata_agents\", \"tags\": [\"ovn_metadata_parallel\"], \"delegate_to\": \"{{ item }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_4\", \"config_id\": [\"ovn_metadata_agent\"], \"config_patterns\": \"*ovn_metadata_agent.json\", \"config_overrides\": {\".*ovn_metadata_agent\": {\"image\": {\"get_param\": \"ContainerOvnMetadataImage\"}, \"name\": \"ovn_metadata_agent\"}}}, \"loop\": \"{{ hosts_to_update_metadata }}\", \"async\": {\"get_param\": \"OVNMetadataImageUpdateTimeout\"}, \"poll\": 0}]}, {\"name\": \"Now rotate all ovn_metadata_agents\", \"vars\": {\"hosts_to_update_metadata\": \"{{ metadata_python_ovs_3_1.results | selectattr('stdout', 'eq', 'REQUIRED') | map(attribute='item') | list }}\"}, \"tags\": [\"never\", \"ovn_metadata_serial\"], \"when\": [\"step|int == 1\", \"hosts_to_update_metadata | length > 0\"], \"delegate_to\": \"{{ item }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_4\", \"config_id\": [\"ovn_metadata_agent\"], \"config_patterns\": \"*ovn_metadata_agent.json\", \"config_overrides\": {\".*ovn_metadata_agent\": {\"image\": {\"get_param\": \"ContainerOvnMetadataImage\"}, \"name\": \"ovn_metadata_agent\"}}}, \"loop\": \"{{ hosts_to_update_metadata }}\", \"loop_control\": {\"pause\": 1}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Neutron API service\\n\", \"parameters\": {\"ContainerNeutronApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NeutronApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.neutron.api\", \"file\": \"/var/log/containers/neutron/server.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"NeutronApiOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\"}, \"NeutronApiOptEnvVars\": {\"default\": {}, \"description\": \"hash of optional environment variables\", \"type\": \"json\"}, \"NeutronWorkers\": {\"default\": \"\", \"description\": \"Sets the number of API workers for the Neutron service.\\nThe default value results in the configuration being left unset\\nand a system-dependent default will be chosen (usually the number\\nof processors). Please note that this can result in a large number\\nof processes and memory consumption on systems with a large core\\ncount. On such systems it is recommended that a non-default value\\nbe selected that matches the load requirements.\\n\", \"type\": \"string\"}, \"NeutronRpcWorkers\": {\"default\": \"\", \"description\": \"Sets the number of RPC workers for the Neutron service.\\nIf not specified, it'll take the value of NeutronWorkers and if this is\\nnot specified either, the default value results in the configuration\\nbeing left unset and a system-dependent default will be chosen\\n(usually 1).\\n\", \"type\": \"string\"}, \"NeutronPassword\": {\"description\": \"The password for the neutron service and db account, used by neutron agents.\", \"type\": \"string\", \"hidden\": true}, \"NeutronAllowL3AgentFailover\": {\"default\": \"True\", \"description\": \"Allow automatic l3-agent failover\", \"type\": \"string\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"NeutronEnableDVR\": {\"description\": \"Enable Neutron DVR.\", \"default\": \"\", \"type\": \"string\"}, \"NeutronEnableIgmpSnooping\": {\"description\": \"Enable IGMP Snooping.\", \"type\": \"boolean\", \"default\": false}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionNeutronServer\": {\"default\": \"overcloud-neutron-server\", \"type\": \"string\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"NeutronApiPolicies\": {\"description\": \"A hash of policies to configure for Neutron API.\\ne.g. { neutron-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"NeutronOvsIntegrationBridge\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Name of Open vSwitch bridge to use\"}, \"NeutronPortQuota\": {\"default\": \"500\", \"type\": \"string\", \"description\": \"Number of ports allowed per tenant, and minus means unlimited.\"}, \"NeutronSecurityGroupQuota\": {\"default\": \"10\", \"type\": \"string\", \"description\": \"Number of security groups allowed per tenant, and minus means unlimited\"}, \"NeutronMechanismDrivers\": {\"default\": \"ovn\", \"description\": \"The mechanism drivers for the Neutron tenant network.\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronDefaultAvailabilityZones\": {\"description\": \"Comma-separated list of default network availability zones to be used by Neutron if its resource is created without availability zone hints. If not set, no AZs will be configured for Neutron network services.\", \"default\": [], \"type\": \"comma_delimited_list\"}, \"NeutronNetworkSchedulerDriver\": {\"description\": \"The network schedule driver to use for avialability zones.\", \"default\": \"neutron.scheduler.dhcp_agent_scheduler.AZAwareWeightScheduler\", \"type\": \"string\"}, \"NeutronRouterSchedulerDriver\": {\"description\": \"The router schedule driver to use for avialability zones.\", \"default\": \"neutron.scheduler.l3_agent_scheduler.AZLeastRoutersScheduler\", \"type\": \"string\"}, \"NeutronDhcpLoadType\": {\"description\": \"Additional to the availability zones aware network scheduler.\", \"default\": \"networks\", \"type\": \"string\"}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"NeutronCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"NeutronL3HA\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Whether to enable HA for virtual routers. When not set, L3 HA will be\\nautomatically enabled if the number of nodes hosting controller\\nconfigurations and DVR is disabled. Valid values are 'true' or 'false'\\nThis parameter is being deprecated in Newton and is scheduled to be\\nremoved in Ocata.  Future releases will enable L3 HA by default if it is\\nappropriate for the deployment type. Alternate mechanisms will be\\navailable to override.\\n\"}, \"NeutronAgentDownTime\": {\"default\": 600, \"type\": \"number\", \"description\": \"Seconds to regard the agent as down; should be at least twice\\nNeutronGlobalReportInterval, to be sure the agent is down for good.\\n\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"NeutronL3HA\"]}], \"conditions\": {\"use_tls_proxy\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"neutron_workers_unset\": {\"equals\": [{\"get_param\": \"NeutronWorkers\"}, \"\"]}, \"neutron_rpc_workers_unset\": {\"equals\": [{\"get_param\": \"NeutronRpcWorkers\"}, \"\"]}, \"neutron_ovs_int_br_unset\": {\"equals\": [{\"get_param\": \"NeutronOvsIntegrationBridge\"}, \"\"]}, \"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"neutron_dvr_unset\": {\"equals\": [{\"get_param\": \"NeutronEnableDVR\"}, \"\"]}, \"is_ovn_in_neutron_mechanism_driver\": {\"contains\": [\"ovn\", {\"get_param\": \"NeutronMechanismDrivers\"}]}, \"az_unset\": {\"equals\": [{\"get_param\": \"NeutronDefaultAvailabilityZones\"}, []]}, \"ovn_and_tls\": {\"and\": [\"is_ovn_in_neutron_mechanism_driver\", \"internal_tls_enabled\"]}, \"enable_sqlalchemy_collectd\": {\"equals\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, true]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"NeutronCertificateKeySize\"}, \"\"]}}, \"resources\": {\"TLSProxyBase\": {\"type\": \"OS::TripleO::Services::TLSProxyBase\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"NeutronBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NeutronLogging\": {\"type\": \"OS::TripleO::Services::Logging::NeutronApi\", \"properties\": {\"NeutronServiceName\": \"server\"}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronApiImage\": \"ContainerNeutronApiImage\", \"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronApiImage\": {\"get_param\": \"ContainerNeutronApiImage\"}, \"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron API role.\", \"value\": {\"service_name\": \"neutron_api\", \"firewall_rules\": {\"114 neutron api\": {\"dport\": [9696]}}, \"firewall_frontend_rules\": {\"100 neutron_haproxy_frontend\": {\"dport\": [9696]}}, \"firewall_ssl_frontend_rules\": {\"100 neutron_haproxy_frontend_ssl\": {\"dport\": [13696]}}, \"keystone_resources\": {\"neutron\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"NeutronPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"NeutronAdmin\", \"uri\"]}}, \"users\": {\"neutron\": {\"password\": {\"get_param\": \"NeutronPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"network\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNeutronServer\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NeutronLogging\", \"config_settings\"]}, {\"neutron::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"neutron\", \"password\": {\"get_param\": \"NeutronPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/ovs_neutron\", \"query\": {\"if\": [\"enable_sqlalchemy_collectd\", {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"ovs_neutron\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"neutron::policy::policies\": {\"get_param\": \"NeutronApiPolicies\"}}, {\"if\": [{\"get_param\": \"EnforceSecureRbac\"}, {\"neutron::policy::enforce_scope\": true, \"neutron::policy::enforce_new_defaults\": true}], \"neutron::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"neutron::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"neutron::server::agent_down_time\": {\"get_param\": \"NeutronAgentDownTime\"}, \"neutron::server::allow_automatic_l3agent_failover\": {\"get_param\": \"NeutronAllowL3AgentFailover\"}, \"neutron::server::enable_proxy_headers_parsing\": true, \"neutron::server::igmp_snooping_enable\": {\"get_param\": \"NeutronEnableIgmpSnooping\"}, \"neutron::keystone::authtoken::password\": {\"get_param\": \"NeutronPassword\"}, \"neutron::server::notifications::nova::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"neutron::server::notifications::nova::project_name\": \"service\", \"neutron::server::notifications::nova::user_domain_name\": \"Default\", \"neutron::server::notifications::nova::project_domain_name\": \"Default\", \"neutron::server::notifications::nova::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"neutron::server::notifications::nova::password\": {\"get_param\": \"NovaPassword\"}, \"neutron::server::notifications::nova::endpoint_type\": \"internal\", \"neutron::keystone::authtoken::project_name\": \"service\", \"neutron::keystone::authtoken::user_domain_name\": \"Default\", \"neutron::keystone::authtoken::project_domain_name\": \"Default\", \"neutron::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"neutron::keystone::authtoken::interface\": \"internal\", \"neutron::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"neutron::quota::quota_port\": {\"get_param\": \"NeutronPortQuota\"}, \"neutron::quota::quota_security_group\": {\"get_param\": \"NeutronSecurityGroupQuota\"}, \"neutron::server::placement::password\": {\"get_param\": \"NovaPassword\"}, \"neutron::server::placement::project_domain_name\": \"Default\", \"neutron::server::placement::project_name\": \"service\", \"neutron::server::placement::user_domain_name\": \"Default\", \"neutron::server::placement::username\": \"nova\", \"neutron::server::placement::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"neutron::server::placement::auth_type\": \"password\", \"neutron::server::placement::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"tripleo::profile::base::neutron::server::tls_proxy_bind_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}, \"tripleo::profile::base::neutron::server::tls_proxy_fqdn\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}, \"tripleo::profile::base::neutron::server::tls_proxy_port\": {\"get_param\": [\"EndpointMap\", \"NeutronInternal\", \"port\"]}, \"neutron::bind_host\": {\"if\": [\"use_tls_proxy\", \"%{hiera('localhost_address')}\", {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}]}, \"tripleo::profile::base::neutron::server::l3_ha_override\": {\"get_param\": \"NeutronL3HA\"}}, {\"if\": [\"neutron_dvr_unset\", {}, {\"neutron::server::router_distributed\": {\"get_param\": \"NeutronEnableDVR\"}, \"neutron::server::enable_dvr\": {\"get_param\": \"NeutronEnableDVR\"}}]}, {\"if\": [\"neutron_workers_unset\", {}, {\"neutron::server::api_workers\": {\"get_param\": \"NeutronWorkers\"}}]}, {\"if\": [\"neutron_rpc_workers_unset\", {\"if\": [\"neutron_workers_unset\", {}, {\"neutron::server::rpc_workers\": {\"get_param\": \"NeutronWorkers\"}}]}, {\"neutron::server::rpc_workers\": {\"get_param\": \"NeutronRpcWorkers\"}}]}, {\"if\": [\"neutron_ovs_int_br_unset\", {}, {\"neutron::server::ovs_integration_bridge\": {\"get_param\": \"NeutronOvsIntegrationBridge\"}}]}, {\"if\": [\"az_unset\", {}, {\"neutron::server::dhcp_load_type\": {\"get_param\": \"NeutronDhcpLoadType\"}, \"neutron::server::network_scheduler_driver\": {\"get_param\": \"NeutronNetworkSchedulerDriver\"}, \"neutron::server::router_scheduler_driver\": {\"get_param\": \"NeutronRouterSchedulerDriver\"}, \"neutron::server::default_availability_zones\": {\"get_param\": \"NeutronDefaultAvailabilityZones\"}}]}, {\"if\": [\"ovn_and_tls\", {\"tripleo::profile::base::neutron::plugins::ml2::ovn::protocol\": \"ssl\", \"tripleo::profile::base::neutron::plugins::ml2::ovn::ovn_nb_private_key\": \"/etc/pki/tls/private/neutron_ovn.key\", \"tripleo::profile::base::neutron::plugins::ml2::ovn::ovn_nb_certificate\": \"/etc/pki/tls/certs/neutron_ovn.crt\", \"tripleo::profile::base::neutron::plugins::ml2::ovn::ovn_sb_private_key\": \"/etc/pki/tls/private/neutron_ovn.key\", \"tripleo::profile::base::neutron::plugins::ml2::ovn::ovn_sb_certificate\": \"/etc/pki/tls/certs/neutron_ovn.crt\", \"tripleo::profile::base::neutron::plugins::ml2::ovn::ovn_nb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo::profile::base::neutron::plugins::ml2::ovn::ovn_sb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}}, {}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_neutron_api\": [{\"get_param\": \"NeutronApiLoggingSource\"}]}, \"mysql\": {\"neutron::db::mysql::password\": {\"get_param\": \"NeutronPassword\"}, \"neutron::db::mysql::user\": \"neutron\", \"neutron::db::mysql::host\": \"%\", \"neutron::db::mysql::dbname\": \"ovs_neutron\"}}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": \"neutron_config,neutron_api_paste_ini\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::neutron::server\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/neutron_api.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/neutron-server --config-file /usr/share/neutron/neutron-dist.conf --config-dir /usr/share/neutron/server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini --config-dir /etc/neutron/conf.d/common --config-dir /etc/neutron/conf.d/neutron-server\", {\"get_attr\": [\"NeutronLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"optional\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/neutron_ovn.crt\", \"owner\": \"neutron:neutron\", \"optional\": true, \"perm\": \"0644\"}, {\"path\": \"/etc/pki/tls/private/neutron_ovn.key\", \"owner\": \"neutron:neutron\", \"optional\": true, \"perm\": \"0644\"}]}, \"/var/lib/kolla/config_files/neutron_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec neutron_api neutron-db-manage upgrade heads\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"optional\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/neutron_ovn.crt\", \"owner\": \"neutron:neutron\", \"optional\": true, \"perm\": \"0644\"}, {\"path\": \"/etc/pki/tls/private/neutron_ovn.key\", \"owner\": \"neutron:neutron\", \"optional\": true, \"perm\": \"0644\"}]}, \"/var/lib/kolla/config_files/neutron_server_tls_proxy.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"NeutronLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"neutron_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"privileged\": false, \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NeutronLogging\", \"volumes\"]}, {\"get_param\": \"NeutronApiOptVolumes\"}, [\"/var/lib/kolla/config_files/neutron_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"map_merge\": [{\"neutron_api\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NeutronLogging\", \"volumes\"]}, {\"get_param\": \"NeutronApiOptVolumes\"}, [\"/var/lib/kolla/config_files/neutron_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro\"], {\"if\": [\"ovn_and_tls\", [\"/etc/pki/tls/certs/neutron_ovn.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/neutron_ovn.crt:ro\", \"/etc/pki/tls/private/neutron_ovn.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/neutron_ovn.key:ro\"], null]}]}, \"environment\": {\"map_merge\": [{\"get_param\": \"NeutronApiOptEnvVars\"}, {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}]}}}, {\"if\": [\"internal_tls_enabled\", {\"neutron_server_tls_proxy\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NeutronLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/neutron_server_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro\", \"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {}]}]}}, \"host_prep_tasks\": {\"get_attr\": [\"NeutronLogging\", \"host_prep_tasks\"]}, \"metadata_settings\": {\"list_concat\": [{\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"metadata_settings\"]}, {\"if\": [\"ovn_and_tls\", [{\"service\": \"neutron_ovn\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}, \"type\": \"node\"}], null]}]}, \"deploy_steps_tasks\": {\"if\": [\"ovn_and_tls\", [{\"name\": \"Certificate generation\", \"when\": \"step|int == 1\", \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"neutron_ovn\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"neutron_ovn/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}, \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"NeutronCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], null]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop neutron api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"neutron_api\"], \"tripleo_delegate_to\": \"{{ groups['neutron_api'] | difference(groups['excluded_overcloud']) }}\"}}]}], \"external_update_tasks\": [{\"name\": \"Check if python3-openvswitch3.1 workaround is needed\", \"delegate_to\": \"{{groups['neutron_api'][0]}}\", \"become\": true, \"tags\": [\"ovn\", \"ovn_image\"], \"when\": \"step|int == 1\", \"shell\": \"podman exec neutron_api rpm -q python3-openvswitch3.1\\n\", \"register\": \"neutron_python_ovs_3_1\", \"failed_when\": false}, {\"name\": \"Update neutron_api first everywhere\", \"become\": true, \"tags\": [\"ovn\", \"ovn_image\"], \"when\": [\"step|int == 1\", \"neutron_python_ovs_3_1.rc == 0\"], \"block\": [{\"name\": \"Move virtual IPs to another node before stopping pacemaker\", \"delegate_to\": \"{{groups['neutron_api'][0]}}\", \"when\": [\"hostvars[groups['neutron_api'][0]][\\\"haproxy_node_names\\\"]|default([])|length > 1\"], \"shell\": \"CLUSTER_NODE=$(crm_node -n)\\necho \\\"Retrieving all the VIPs which are hosted on this node\\\"\\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\\\"ocf:heartbeat:IPaddr2\\\" and @role = \\\"Started\\\" and @managed = \\\"true\\\" and ./node[@name = \\\"'${CLUSTER_NODE}'\\\"]]/@id' - | sed -e 's/id=//g' -e 's/\\\"//g')\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Moving VIP $v on another node\\\"\\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\\ndone\\necho \\\"Removing the location constraints that were created to move the VIPs\\\"\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Removing location ban for VIP $v\\\"\\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\\\"'${v}'\\\" and @node=\\\"'${CLUSTER_NODE}'\\\" and @score=\\\"-INFINITY\\\"]/@id)' -)\\n    if [ -n \\\"$ban_id\\\" ]; then\\n        pcs constraint remove ${ban_id}\\n    else\\n        echo \\\"Could not retrieve and clear location constraint for VIP $v\\\" 2>&1\\n    fi\\ndone\\n\"}, {\"name\": \"Create firewall nat prerouting and postrouting\", \"delegate_to\": \"{{groups['neutron_api'][0]}}\", \"shell\": \"set -o pipefail\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][0]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nif [[ $IP =~ .*:.* ]]\\n  then\\n       PROTOCOL=\\\"ip6\\\"\\n       # we need to temporarly allow ipv6 forwarding, this will get reset by deployment run\\n       sysctl -w net.ipv6.conf.all.forwarding=1\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nnft add table $PROTOCOL nat\\nnft -- add chain $PROTOCOL nat prerouting { type nat hook prerouting priority -100 \\\\; }\\nnft add chain $PROTOCOL nat postrouting { type nat hook postrouting priority 100 \\\\; }\\n\"}, {\"name\": \"Redirect neutron backend traffic for 60s to other host\", \"delegate_to\": \"{{groups['neutron_api'][0]}}\", \"shell\": \"set -o pipefail\\nsource /etc/os-release; test  \\\"${VERSION_ID%*}\\\" = \\\"9.0\\\" && exit 0\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][0]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nREMOTE_BACKEND=$(grep \\\":9696 \\\" /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep server | grep -v {{groups['neutron_api'][0]}} | head -n1 | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nPORT=9696\\nif [[ $IP =~ .*:.* ]]\\n  then PROTOCOL=\\\"ip6\\\"\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nREMOTE_IP=${REMOTE_BACKEND%:*}\\nnft add rule $PROTOCOL nat postrouting $PROTOCOL daddr $REMOTE_IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) masquerade comment neutron_api\\nnft add rule $PROTOCOL nat prerouting $PROTOCOL daddr $IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) dnat to $REMOTE_IP comment neutron_api\\n\"}, {\"name\": \"Insanity neutron update first\", \"delegate_to\": \"{{groups['neutron_api'][0]}}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_4\", \"config_id\": [\"neutron_api\"], \"config_patterns\": \"*neutron_api.json\", \"config_overrides\": {\".*neutron_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"name\": \"neutron_api\"}}}}, {\"wait_for\": {\"timeout\": 50}}, {\"name\": \"Delete redirect rules\", \"delegate_to\": \"{{groups['neutron_api'][0]}}\", \"shell\": \"set -o pipefail\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][0]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nif [[ $IP =~ .*:.* ]]\\n  then\\n       PROTOCOL=\\\"ip6\\\"\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nnft -a list chain $PROTOCOL nat postrouting | grep neutron_api | awk -F# '{print \\\"nat postrouting \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"nft delete rule $PROTOCOL $i\\\"; done\\nnft -a list chain $PROTOCOL nat prerouting | grep neutron_api | awk -F# '{print \\\"nat prerouting \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"nft delete rule $PROTOCOL $i\\\"; done\\n\"}, {\"name\": \"Move virtual IPs to another node before stopping pacemaker\", \"delegate_to\": \"{{groups['neutron_api'][1]}}\", \"when\": [\"hostvars[groups['neutron_api'][1]][\\\"haproxy_node_names\\\"]|default([])|length > 1\", \"groups['neutron_api'] | default([]) | length > 1\"], \"shell\": \"CLUSTER_NODE=$(crm_node -n)\\necho \\\"Retrieving all the VIPs which are hosted on this node\\\"\\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\\\"ocf:heartbeat:IPaddr2\\\" and @role = \\\"Started\\\" and @managed = \\\"true\\\" and ./node[@name = \\\"'${CLUSTER_NODE}'\\\"]]/@id' - | sed -e 's/id=//g' -e 's/\\\"//g')\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Moving VIP $v on another node\\\"\\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\\ndone\\necho \\\"Removing the location constraints that were created to move the VIPs\\\"\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Removing location ban for VIP $v\\\"\\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\\\"'${v}'\\\" and @node=\\\"'${CLUSTER_NODE}'\\\" and @score=\\\"-INFINITY\\\"]/@id)' -)\\n    if [ -n \\\"$ban_id\\\" ]; then\\n        pcs constraint remove ${ban_id}\\n    else\\n        echo \\\"Could not retrieve and clear location constraint for VIP $v\\\" 2>&1\\n    fi\\ndone\\n\"}, {\"name\": \"Create firewall nat prerouting and postrouting\", \"delegate_to\": \"{{groups['neutron_api'][1]}}\", \"when\": [\"groups['neutron_api'] | default([]) | length > 1\"], \"shell\": \"set -o pipefail\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][1]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nif [[ $IP =~ .*:.* ]]\\n  then\\n       PROTOCOL=\\\"ip6\\\"\\n       # we need to temporarly allow ipv6 forwarding, this will get reset by deployment run\\n       sysctl -w net.ipv6.conf.all.forwarding=1\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nnft add table $PROTOCOL nat\\nnft -- add chain $PROTOCOL nat prerouting { type nat hook prerouting priority -100 \\\\; }\\nnft add chain $PROTOCOL nat postrouting { type nat hook postrouting priority 100 \\\\; }\\n\"}, {\"name\": \"Redirect neutron backend traffic for 60s to other host\", \"delegate_to\": \"{{groups['neutron_api'][1]}}\", \"when\": [\"groups['neutron_api'] | default([]) | length > 1\"], \"shell\": \"set -o pipefail\\nsource /etc/os-release; test  \\\"${VERSION_ID%*}\\\" = \\\"9.0\\\" && exit 0\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][1]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nREMOTE_BACKEND=$(grep \\\":9696 \\\" /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep server | grep -v {{groups['neutron_api'][1]}} | head -n1 | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nPORT=9696\\nif [[ $IP =~ .*:.* ]]\\n  then PROTOCOL=\\\"ip6\\\"\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nREMOTE_IP=${REMOTE_BACKEND%:*}\\nnft add rule $PROTOCOL nat postrouting $PROTOCOL daddr $REMOTE_IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) masquerade comment neutron_api\\nnft add rule $PROTOCOL nat prerouting $PROTOCOL daddr $IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) dnat to $REMOTE_IP comment neutron_api\\n\"}, {\"name\": \"Insanity neutron update first\", \"delegate_to\": \"{{groups['neutron_api'][1]}}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_4\", \"config_id\": [\"neutron_api\"], \"config_patterns\": \"*neutron_api.json\", \"config_overrides\": {\".*neutron_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"name\": \"neutron_api\"}}}, \"when\": [\"groups['neutron_api'] | default([]) | length > 1\"]}, {\"wait_for\": {\"timeout\": 50}, \"when\": [\"groups['neutron_api'] | default([]) | length > 1\"]}, {\"name\": \"Delete redirect rules\", \"delegate_to\": \"{{groups['neutron_api'][1]}}\", \"when\": [\"groups['neutron_api'] | default([]) | length > 1\"], \"shell\": \"set -o pipefail\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][1]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nif [[ $IP =~ .*:.* ]]\\n  then PROTOCOL=\\\"ip6\\\"\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nnft -a list chain $PROTOCOL nat postrouting | grep neutron_api | awk -F# '{print \\\"nat postrouting \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"nft delete rule $PROTOCOL $i\\\"; done\\nnft -a list chain $PROTOCOL nat prerouting | grep neutron_api | awk -F# '{print \\\"nat prerouting \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"nft delete rule $PROTOCOL $i\\\"; done\\n\"}, {\"name\": \"Move virtual IPs to another node before stopping pacemaker\", \"delegate_to\": \"{{groups['neutron_api'][2]}}\", \"when\": [\"hostvars[groups['neutron_api'][2]][\\\"haproxy_node_names\\\"]|default([])|length > 1\", \"groups['neutron_api'] | default([]) | length > 2\"], \"shell\": \"CLUSTER_NODE=$(crm_node -n)\\necho \\\"Retrieving all the VIPs which are hosted on this node\\\"\\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\\\"ocf:heartbeat:IPaddr2\\\" and @role = \\\"Started\\\" and @managed = \\\"true\\\" and ./node[@name = \\\"'${CLUSTER_NODE}'\\\"]]/@id' - | sed -e 's/id=//g' -e 's/\\\"//g')\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Moving VIP $v on another node\\\"\\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\\ndone\\necho \\\"Removing the location constraints that were created to move the VIPs\\\"\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Removing location ban for VIP $v\\\"\\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\\\"'${v}'\\\" and @node=\\\"'${CLUSTER_NODE}'\\\" and @score=\\\"-INFINITY\\\"]/@id)' -)\\n    if [ -n \\\"$ban_id\\\" ]; then\\n        pcs constraint remove ${ban_id}\\n    else\\n        echo \\\"Could not retrieve and clear location constraint for VIP $v\\\" 2>&1\\n    fi\\ndone\\n\"}, {\"name\": \"Create firewall nat prerouting and postrouting\", \"delegate_to\": \"{{groups['neutron_api'][2]}}\", \"when\": [\"groups['neutron_api'] | default([]) | length > 2\"], \"shell\": \"set -o pipefail\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][2]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nif [[ $IP =~ .*:.* ]]\\n  then\\n       PROTOCOL=\\\"ip6\\\"\\n       # we need to temporarly allow ipv6 forwarding, this will get reset by deployment run\\n       sysctl -w net.ipv6.conf.all.forwarding=1\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nnft add table $PROTOCOL nat\\nnft -- add chain $PROTOCOL nat prerouting { type nat hook prerouting priority -100 \\\\; }\\nnft add chain $PROTOCOL nat postrouting { type nat hook postrouting priority 100 \\\\; }\\n\"}, {\"name\": \"Redirect neutron backend traffic for 60s to other host\", \"delegate_to\": \"{{groups['neutron_api'][2]}}\", \"when\": [\"groups['neutron_api'] | default([]) | length > 2\"], \"shell\": \"set -o pipefail\\nsource /etc/os-release; test  \\\"${VERSION_ID%*}\\\" = \\\"9.0\\\" && exit 0\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][2]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nREMOTE_BACKEND=$(grep \\\":9696 \\\" /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep server | grep -v {{groups['neutron_api'][2]}} | head -n1 | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nPORT=9696\\nif [[ $IP =~ .*:.* ]]\\n  then PROTOCOL=\\\"ip6\\\"\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nREMOTE_IP=${REMOTE_BACKEND%:*}\\nnft add rule $PROTOCOL nat postrouting $PROTOCOL daddr $REMOTE_IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) masquerade comment neutron_api\\nnft add rule $PROTOCOL nat prerouting $PROTOCOL daddr $IP tcp dport 9696 counter meta time $(date +%s)-$(date -d'+60 seconds' +%s) dnat to $REMOTE_IP comment neutron_api\\n\"}, {\"name\": \"Insanity neutron update first\", \"delegate_to\": \"{{groups['neutron_api'][2]}}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_4\", \"config_id\": [\"neutron_api\"], \"config_patterns\": \"*neutron_api.json\", \"config_overrides\": {\".*neutron_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"name\": \"neutron_api\"}}}, \"when\": [\"groups['neutron_api'] | default([]) | length > 2\"]}, {\"wait_for\": {\"timeout\": 50}, \"when\": [\"groups['neutron_api'] | default([]) | length > 2\"]}, {\"name\": \"Delete redirect rules\", \"delegate_to\": \"{{groups['neutron_api'][2]}}\", \"shell\": \"set -o pipefail\\nLOCAL_BACKEND=$(grep {{groups['neutron_api'][2]}} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | \\\\\\n  grep \\\":9696 \\\" | awk '{print $3}')\\nIP=${LOCAL_BACKEND%:*}\\nif [[ $IP =~ .*:.* ]]\\n  then PROTOCOL=\\\"ip6\\\"\\n  else PROTOCOL=\\\"ip\\\"\\nfi\\nnft -a list chain $PROTOCOL nat postrouting | grep neutron_api | awk -F# '{print \\\"nat postrouting \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"nft delete rule $PROTOCOL $i\\\"; done\\nnft -a list chain $PROTOCOL nat prerouting | grep neutron_api | awk -F# '{print \\\"nat prerouting \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"nft delete rule $PROTOCOL $i\\\"; done\\n\", \"when\": [\"groups['neutron_api'] | default([]) | length > 2\"]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Neutron ML2 Plugin configured with Puppet\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"NeutronPluginMl2PuppetTags\": {\"default\": \"neutron_plugin_ml2\", \"description\": \"Puppet resource tag names that are used to generate config files with puppet\", \"type\": \"string\"}}, \"resources\": {\"NeutronBase\": {\"type\": \"OS::TripleO::Services::NeutronMl2PluginBase\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron ML2 Plugin role.\", \"value\": {\"service_name\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"service_name\"]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}]}, \"service_config_settings\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"service_config_settings\"]}, \"metadata_settings\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"metadata_settings\"]}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": {\"get_param\": \"NeutronPluginMl2PuppetTags\"}, \"step_config\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"step_config\"]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {}, \"docker_config\": {}, \"host_prep_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-compute-plugin-nuage.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron Compute Nuage plugin\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"NuageMetadataPort\": {\"description\": \"TCP Port to listen for metadata server requests\", \"type\": \"string\", \"default\": \"9697\"}, \"NuageActiveController\": {\"description\": \"IP address of the Active Virtualized Services Controller (VSC)\", \"type\": \"string\"}, \"NuageStandbyController\": {\"description\": \"IP address of the Standby Virtualized Services Controller (VSC)\", \"type\": \"string\"}, \"NuageNovaMetadataPort\": {\"description\": \"TCP Port used by Nova metadata server\", \"type\": \"string\", \"default\": \"8775\"}, \"NuageMetadataProxySharedSecret\": {\"description\": \"Shared secret to sign the instance-id request\", \"type\": \"string\"}, \"NuageNovaClientVersion\": {\"description\": \"Client Version Nova\", \"type\": \"string\", \"default\": \"2\"}, \"NuageNovaOsUsername\": {\"description\": \"Nova username in keystone_authtoken\", \"type\": \"string\", \"default\": \"nova\"}, \"NuageMetadataAgentStartWithOvs\": {\"description\": \"Set to true if nuage-metadata-agent needs to be started with nuage-openvswitch-switch\", \"type\": \"boolean\", \"default\": true}, \"NuageNovaApiEndpoint\": {\"description\": \"One of publicURL, internalURL, adminURL in \\\"keystone endpoint-list\\\"\", \"type\": \"string\", \"default\": \"publicURL\"}, \"NuageNovaRegionName\": {\"description\": \"Region name in \\\"keystone endpoint-list\\\"\", \"type\": \"string\", \"default\": \"regionOne\"}, \"NuageBridgeMTU\": {\"description\": \"Support for non-default MTU configured on each VRS node\", \"type\": \"string\", \"default\": \"\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron Compute Nuage plugin\", \"firewall_rules\": {\"118 neutron vxlan networks\": {\"proto\": \"udp\", \"dport\": 4789}, \"100 metadata agent\": {\"dport\": {\"get_param\": \"NuageMetadataPort\"}}}, \"value\": {\"service_name\": \"neutron_compute_plugin_nuage\", \"config_settings\": {\"nuage::vrs::active_controller\": {\"get_param\": \"NuageActiveController\"}, \"nuage::vrs::standby_controller\": {\"get_param\": \"NuageStandbyController\"}, \"nuage::vrs::bridge_mtu\": {\"get_param\": \"NuageBridgeMTU\"}, \"nuage::metadataagent::metadata_port\": {\"get_param\": \"NuageMetadataPort\"}, \"nuage::metadataagent::nova_metadata_port\": {\"get_param\": \"NuageNovaMetadataPort\"}, \"nuage::metadataagent::metadata_secret\": {\"get_param\": \"NuageMetadataProxySharedSecret\"}, \"nuage::metadataagent::nova_client_version\": {\"get_param\": \"NuageNovaClientVersion\"}, \"nuage::metadataagent::nova_os_username\": {\"get_param\": \"NuageNovaOsUsername\"}, \"nuage::metadataagent::metadata_agent_start_with_ovs\": {\"get_param\": \"NuageMetadataAgentStartWithOvs\"}, \"nuage::metadataagent::nova_api_endpoint_type\": {\"get_param\": \"NuageNovaApiEndpoint\"}, \"nuage::metadataagent::nova_region_name\": {\"get_param\": \"NuageNovaRegionName\"}, \"tripleo::profile::base::neutron::agents::nuage::nova_os_tenant_name\": \"service\", \"tripleo::profile::base::neutron::agents::nuage::nova_os_password\": {\"get_param\": \"NovaPassword\"}, \"tripleo::profile::base::neutron::agents::nuage::nova_auth_ip\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"host\"]}}, \"step_config\": \"include tripleo::profile::base::neutron::agents::nuage\"}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron ML2 Plugin configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NeutronMechanismDrivers\": {\"default\": \"ovn\", \"description\": \"The mechanism drivers for the Neutron tenant network.\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronTypeDrivers\": {\"default\": \"geneve,vxlan,vlan,flat\", \"description\": \"Comma-separated list of network type driver entrypoints to be loaded.\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronFlatNetworks\": {\"type\": \"comma_delimited_list\", \"default\": \"datacentre\", \"description\": \"If set, flat networks to configure in neutron plugins.\"}, \"NeutronPluginExtensions\": {\"default\": \"qos,port_security,dns_domain_ports\", \"description\": \"Comma-separated list of extensions enabled for the Neutron plugin.\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronNetworkVLANRanges\": {\"default\": \"datacentre:1:1000\", \"description\": \"The Neutron ML2 and OpenVSwitch vlan mapping range to support. See the Neutron documentation for permitted values. Defaults to permitting VLANs 1 to 1000 on the 'datacentre' physical network (See NeutronBridgeMappings).\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronTunnelIdRanges\": {\"description\": \"Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges\\nof GRE tunnel IDs that are available for tenant network allocation\\n\", \"default\": [\"1:4094\"], \"type\": \"comma_delimited_list\"}, \"NeutronVniRanges\": {\"description\": \"Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges\\nof VXLAN VNI IDs that are available for tenant network allocation\\n\", \"default\": [\"1:65536\"], \"type\": \"comma_delimited_list\"}, \"NeutronNetworkType\": {\"default\": \"geneve\", \"description\": \"The tenant network type for Neutron.\", \"type\": \"comma_delimited_list\"}, \"NeutronOverlayIPVersion\": {\"default\": 4, \"description\": \"IP version used for all overlay network endpoints.\", \"type\": \"number\", \"constraints\": [{\"allowed_values\": [4, 6]}]}, \"NeutronML2PhysicalNetworkMtus\": {\"default\": [], \"description\": \"A list of mappings of physical networks to MTU values. The format of\\nthe mapping is <physnet>:<mtu val>. This mapping allows specifying a\\nphysical network MTU value that differs from the default segment_mtu\\nvalue in ML2 plugin. And overwrite values from global_physnet_mtu for\\nselected network.\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronOvsVnicTypeBlacklist\": {\"description\": \"Comma-separated list of VNIC types for which support in Neutron is\\nadministratively prohibited by the OVS mechanism driver.\\n\", \"type\": \"comma_delimited_list\", \"default\": \"\"}, \"NeutronSriovVnicTypeBlacklist\": {\"description\": \"Comma-separated list of VNIC types for which support in Neutron is administratively prohibited by the SR-IOV mechanism driver.\\n\", \"type\": \"comma_delimited_list\", \"default\": \"\"}, \"NeutronFirewallDriver\": {\"description\": \"Firewall driver for realizing neutron security group function\", \"type\": \"string\", \"default\": \"\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"NeutronOverlayIPVersion\"]}], \"conditions\": {\"physical_network_mtus_set\": {\"not\": {\"equals\": [{\"get_param\": \"NeutronML2PhysicalNetworkMtus\"}, []]}}}, \"resources\": {\"NeutronBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron ML2 plugin.\", \"value\": {\"service_name\": \"neutron_plugin_ml2\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}, {\"neutron::plugins::ml2::mechanism_drivers\": {\"get_param\": \"NeutronMechanismDrivers\"}, \"neutron::plugins::ml2::type_drivers\": {\"get_param\": \"NeutronTypeDrivers\"}, \"neutron::plugins::ml2::flat_networks\": {\"get_param\": \"NeutronFlatNetworks\"}, \"neutron::plugins::ml2::extension_drivers\": {\"get_param\": \"NeutronPluginExtensions\"}, \"neutron::plugins::ml2::network_vlan_ranges\": {\"get_param\": \"NeutronNetworkVLANRanges\"}, \"neutron::plugins::ml2::tunnel_id_ranges\": {\"get_param\": \"NeutronTunnelIdRanges\"}, \"neutron::plugins::ml2::vni_ranges\": {\"get_param\": \"NeutronVniRanges\"}, \"neutron::plugins::ml2::tenant_network_types\": {\"get_param\": \"NeutronNetworkType\"}, \"neutron::plugins::ml2::ovs_driver::vnic_type_blacklist\": {\"get_param\": \"NeutronOvsVnicTypeBlacklist\"}, \"neutron::plugins::ml2::sriov_driver::vnic_type_blacklist\": {\"get_param\": \"NeutronSriovVnicTypeBlacklist\"}, \"neutron::plugins::ml2::overlay_ip_version\": {\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"NeutronTenantNetwork\"]}]}}, {\"if\": [\"physical_network_mtus_set\", {\"neutron::plugins::ml2::physical_network_mtus\": {\"get_param\": \"NeutronML2PhysicalNetworkMtus\"}}, null]}]}, \"step_config\": \"include tripleo::profile::base::neutron::plugins::ml2\\n\", \"service_config_settings\": {\"horizon\": {\"neutron::plugins::ml2::mechanism_drivers\": {\"get_param\": \"NeutronMechanismDrivers\"}}}, \"metadata_settings\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"metadata_settings\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2-ovn.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron ML2/OVN plugin configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"OVNSouthboundServerPort\": {\"description\": \"Port of the OVN Southbound DB server\", \"type\": \"number\", \"default\": 6642}, \"OVNNorthboundServerPort\": {\"description\": \"Port of the OVN Northbound DB server\", \"type\": \"number\", \"default\": 6641}, \"OVNDbConnectionTimeout\": {\"description\": \"Timeout in seconds for the OVSDB connection transaction\", \"type\": \"number\", \"default\": 180}, \"OVNOvsdbProbeInterval\": {\"description\": \"Probe interval in ms for the OVSDB session\", \"type\": \"number\", \"default\": 60000}, \"OVNNeutronSyncMode\": {\"description\": \"The synchronization mode of OVN with Neutron DB\", \"type\": \"string\", \"default\": \"log\", \"constraints\": [{\"allowed_values\": [\"log\", false, \"repair\"]}]}, \"OVNQosDriver\": {\"description\": \"OVN notification driver for Neutron QOS service plugin\", \"type\": \"string\", \"default\": \"ovn-qos\"}, \"NeutronGeneveMaxHeaderSize\": {\"description\": \"Geneve encapsulation header size\", \"type\": \"number\", \"default\": 38}, \"NeutronEnableDVR\": {\"description\": \"Enable Neutron DVR.\", \"default\": \"\", \"type\": \"string\"}, \"NeutronEnableIgmpSnooping\": {\"description\": \"Enable IGMP Snooping.\", \"type\": \"boolean\", \"default\": false}, \"OVNMetadataEnabled\": {\"description\": \"Whether Metadata Service has to be enabled\", \"type\": \"boolean\", \"default\": true}, \"OVNDnsServers\": {\"default\": [], \"description\": \"List of servers to use as as dns forwarders\", \"type\": \"comma_delimited_list\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"NeutronVhostuserSocketDir\": {\"default\": \"\", \"description\": \"The vhost-user socket directory for OVS\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"OVNEmitNeedToFrag\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Configure OVN to emit \\\"need to frag\\\" packets in case of MTU mismatches. You may have to disable this option if you are running an old host kernel (version < 5.2). You may check the output of the following command: 'ovs-appctl -t ovs-vswitchd dpif/show-dp-features \\\\ br-int | grep \\\"Check pkt length action\\\"'.\\n\"}, \"NeutronOVNLoggingRateLimit\": {\"default\": 100, \"description\": \"Maximum number of packets logging per second\\n\", \"type\": \"number\"}, \"NeutronOVNLoggingBurstLimit\": {\"default\": 25, \"description\": \"Maximum number of packets per rate_limit\\n\", \"type\": \"number\"}, \"NeutronOVNLoggingLocalOutputLogBase\": {\"default\": \"\", \"description\": \"Output logfile path on agent side, default syslog file\\n\", \"type\": \"string\"}}, \"conditions\": {\"neutron_dvr_unset\": {\"equals\": [{\"get_param\": \"NeutronEnableDVR\"}, \"\"]}, \"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"vhostuser_dir_set\": {\"or\": [{\"not\": {\"equals\": [{\"get_param\": \"NeutronVhostuserSocketDir\"}, \"\"]}}, {\"not\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NeutronVhostuserSocketDir\"]}, \"\"]}}]}, \"network_log_local_output_log_base_set\": {\"not\": {\"equals\": [{\"get_param\": \"NeutronOVNLoggingLocalOutputLogBase\"}, \"\"]}}}, \"resources\": {\"NeutronMl2Base\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron ML2/OVN plugin.\", \"value\": {\"service_name\": \"neutron_plugin_ml2_ovn\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"config_settings\"]}, {\"ovn::southbound::port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"ovn::northbound::port\": {\"get_param\": \"OVNNorthboundServerPort\"}, \"neutron::plugins::ml2::ovn::ovsdb_connection_timeout\": {\"get_param\": \"OVNDbConnectionTimeout\"}, \"neutron::plugins::ml2::ovn::ovsdb_probe_interval\": {\"get_param\": \"OVNOvsdbProbeInterval\"}, \"neutron::plugins::ml2::ovn::neutron_sync_mode\": {\"get_param\": \"OVNNeutronSyncMode\"}, \"neutron::plugins::ml2::ovn::ovn_metadata_enabled\": {\"get_param\": \"OVNMetadataEnabled\"}, \"neutron::server::qos_notification_drivers\": {\"get_param\": \"OVNQosDriver\"}, \"neutron::server::igmp_snooping_enable\": {\"get_param\": \"NeutronEnableIgmpSnooping\"}, \"neutron::plugins::ml2::max_header_size\": {\"get_param\": \"NeutronGeneveMaxHeaderSize\"}, \"neutron::plugins::ml2::ovn::dns_servers\": {\"get_param\": \"OVNDnsServers\"}, \"neutron::plugins::ml2::ovn::ovn_emit_need_to_frag\": {\"get_param\": \"OVNEmitNeedToFrag\"}}, {\"if\": [\"internal_tls_enabled\", {\"neutron::plugins::ml2::ovn::ovn_sb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"neutron::plugins::ml2::ovn::ovn_sb_certificate\": \"/etc/pki/tls/certs/ovn_neutron_client.crt\", \"neutron::plugins::ml2::ovn::ovn_sb_private_key\": \"/etc/pki/tls/private/ovn_neutron_client.key\", \"neutron::plugins::ml2::ovn::ovn_nb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"neutron::plugins::ml2::ovn::ovn_nb_certificate\": \"/etc/pki/tls/certs/ovn_neutron_client.crt\", \"neutron::plugins::ml2::ovn::ovn_nb_private_key\": \"/etc/pki/tls/private/ovn_neutron_client.key\"}, {}]}, {\"if\": [\"neutron_dvr_unset\", {\"neutron::plugins::ml2::ovn::dvr_enabled\": true}, {\"neutron::plugins::ml2::ovn::dvr_enabled\": {\"get_param\": \"NeutronEnableDVR\"}}]}, {\"if\": [\"vhostuser_dir_set\", {\"map_replace\": [{\"map_replace\": [{\"neutron::plugins::ml2::ovn::vhostuser_socket_dir\": \"NeutronVhostuserSocketDir\"}, {\"values\": {\"get_param\": \"RoleParameters\"}}]}, {\"values\": {\"NeutronVhostuserSocketDir\": {\"get_param\": \"NeutronVhostuserSocketDir\"}}}]}, {}]}, {\"neutron::plugins::ml2::ovn::network_log_rate_limit\": {\"get_param\": \"NeutronOVNLoggingRateLimit\"}}, {\"neutron::plugins::ml2::ovn::network_log_burst_limit\": {\"get_param\": \"NeutronOVNLoggingBurstLimit\"}}, {\"if\": [\"network_log_local_output_log_base_set\", {\"neutron::plugins::ml2::ovn::network_log_local_output_log_base\": {\"get_param\": \"NeutronOVNLoggingLocalOutputLogBase\"}}]}]}, \"step_config\": \"include tripleo::profile::base::neutron::plugins::ml2\\n\", \"metadata_settings\": {\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"metadata_settings\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-nuage.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron Nuage plugin\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NeutronNuageNetPartitionName\": {\"description\": \"Specifies the title that you will see on the VSD\", \"type\": \"string\", \"default\": \"default_name\"}, \"NeutronNuageVSDIp\": {\"description\": \"IP address and port of the Virtual Services Directory\", \"type\": \"string\"}, \"NeutronNuageVSDUsername\": {\"description\": \"Username to be used to log into VSD\", \"type\": \"string\"}, \"NeutronNuageVSDPassword\": {\"description\": \"Password to be used to log into VSD\", \"type\": \"string\"}, \"NeutronNuageVSDOrganization\": {\"description\": \"Organization parameter required to log into VSD\", \"type\": \"string\", \"default\": \"organization\"}, \"NeutronNuageBaseURIVersion\": {\"description\": \"URI version to be used based on the VSD release\", \"type\": \"string\", \"default\": \"default_uri_version\"}, \"NeutronNuageCMSId\": {\"description\": \"Cloud Management System ID (CMS ID) to distinguish between OS instances on the same VSD\", \"type\": \"string\"}, \"UseForwardedFor\": {\"description\": \"Treat X-Forwarded-For as the canonical remote address. Only enable this if you have a sanitizing proxy.\", \"type\": \"boolean\", \"default\": false}}, \"resources\": {\"NeutronBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron Nuage plugin\", \"value\": {\"service_name\": \"neutron_plugin_nuage\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}, {\"neutron::plugins::nuage::nuage_net_partition_name\": {\"get_param\": \"NeutronNuageNetPartitionName\"}, \"neutron::plugins::nuage::nuage_vsd_ip\": {\"get_param\": \"NeutronNuageVSDIp\"}, \"neutron::plugins::nuage::nuage_vsd_username\": {\"get_param\": \"NeutronNuageVSDUsername\"}, \"neutron::plugins::nuage::nuage_vsd_password\": {\"get_param\": \"NeutronNuageVSDPassword\"}, \"neutron::plugins::nuage::nuage_vsd_organization\": {\"get_param\": \"NeutronNuageVSDOrganization\"}, \"neutron::plugins::nuage::nuage_base_uri_version\": {\"get_param\": \"NeutronNuageBaseURIVersion\"}, \"neutron::plugins::nuage::nuage_cms_id\": {\"get_param\": \"NeutronNuageCMSId\"}, \"nova::api::use_forwarded_for\": {\"get_param\": \"UseForwardedFor\"}}]}, \"step_config\": \"include tripleo::profile::base::neutron::plugins::nuage\\n\", \"metadata_settings\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"metadata_settings\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2-nuage.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron ML2/Nuage plugin configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NeutronNuageNetPartitionName\": {\"description\": \"Specifies the title that you will see on the VSD\", \"type\": \"string\", \"default\": \"default_name\"}, \"NeutronNuageVSDIp\": {\"description\": \"IP address and port of the Virtual Services Directory\", \"type\": \"string\"}, \"NeutronNuageVSDUsername\": {\"description\": \"Username to be used to log into VSD\", \"type\": \"string\"}, \"NeutronNuageVSDPassword\": {\"description\": \"Password to be used to log into VSD\", \"type\": \"string\"}, \"NeutronNuageVSDOrganization\": {\"description\": \"Organization parameter required to log into VSD\", \"type\": \"string\", \"default\": \"organization\"}, \"NeutronNuageBaseURIVersion\": {\"description\": \"URI version to be used based on the VSD release\", \"type\": \"string\", \"default\": \"default_uri_version\"}, \"NeutronNuageCMSId\": {\"description\": \"Cloud Management System ID (CMS ID) to distinguish between OS instances on the same VSD\", \"type\": \"string\"}, \"UseForwardedFor\": {\"description\": \"Treat X-Forwarded-For as the canonical remote address. Only enable this if you have a sanitizing proxy.\", \"type\": \"boolean\", \"default\": false}, \"NovaPatchConfigMonkeyPatch\": {\"description\": \"Apply monkey patching or not\", \"type\": \"boolean\", \"default\": false}, \"NovaPatchConfigMonkeyPatchModules\": {\"description\": \"List of modules/decorators to monkey patch\", \"type\": \"comma_delimited_list\", \"default\": \"\"}, \"NuageDefaultAllowNonIP\": {\"description\": \"To allow non-IP traffic by default\", \"type\": \"boolean\", \"default\": false}}, \"resources\": {\"NeutronMl2Base\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron ML2/Nuage plugin\", \"value\": {\"service_name\": \"neutron_plugin_ml2_nuage\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"config_settings\"]}, {\"neutron::plugins::ml2::nuage::nuage_net_partition_name\": {\"get_param\": \"NeutronNuageNetPartitionName\"}, \"neutron::plugins::ml2::nuage::nuage_vsd_ip\": {\"get_param\": \"NeutronNuageVSDIp\"}, \"neutron::plugins::ml2::nuage::nuage_vsd_username\": {\"get_param\": \"NeutronNuageVSDUsername\"}, \"neutron::plugins::ml2::nuage::nuage_vsd_password\": {\"get_param\": \"NeutronNuageVSDPassword\"}, \"neutron::plugins::ml2::nuage::nuage_vsd_organization\": {\"get_param\": \"NeutronNuageVSDOrganization\"}, \"neutron::plugins::ml2::nuage::nuage_base_uri_version\": {\"get_param\": \"NeutronNuageBaseURIVersion\"}, \"neutron::plugins::ml2::nuage::nuage_cms_id\": {\"get_param\": \"NeutronNuageCMSId\"}, \"neutron::plugins::ml2::nuage::nuage_default_allow_non_ip\": {\"get_param\": \"NuageDefaultAllowNonIP\"}, \"nova::api::use_forwarded_for\": {\"get_param\": \"UseForwardedFor\"}, \"nova::patch::config::monkey_patch\": {\"get_param\": \"NovaPatchConfigMonkeyPatch\"}, \"nova::patch::config::monkey_patch_modules\": {\"get_param\": \"NovaPatchConfigMonkeyPatchModules\"}}]}, \"step_config\": \"include tripleo::profile::base::neutron::plugins::ml2\\n\", \"metadata_settings\": {\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"metadata_settings\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-nsx-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Neutron NSX Plugin configured with Puppet\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"NeutronPluginNsxPuppetTags\": {\"default\": \"neutron_plugin_nsx\", \"description\": \"Puppet resource tag names that are used to generate config files with puppet\", \"type\": \"string\"}, \"DefaultOverlayTz\": {\"description\": \"Name or UUID of the default NSX overlay transport zone.\", \"type\": \"string\"}, \"DefaultVlanTz\": {\"default\": \"\", \"description\": \"Name or UUID of the default NSX VLAN transport zone.\", \"type\": \"string\"}, \"DefaultBridgeCluster\": {\"default\": \"\", \"description\": \"Name or UUID of the default NSX bridge cluster that will be used to perform L2 gateway bridging between VXLAN and VLAN networks.\", \"type\": \"string\"}, \"DefaultTier0Router\": {\"description\": \"UUID of the default tier0 router that will be used for connecting to tier1 logical routers and configuring external networks.\", \"type\": \"string\"}, \"NsxApiManagers\": {\"description\": \"IP address of one or more NSX managers separated by commas.\", \"type\": \"string\"}, \"NsxApiUser\": {\"description\": \"User name of NSX Manager.\", \"type\": \"string\"}, \"NsxApiPassword\": {\"description\": \"Password of NSX Manager.\", \"type\": \"string\"}, \"NativeDhcpMetadata\": {\"default\": true, \"description\": \"This is the flag to indicate if using native DHCP/Metadata or not.\", \"type\": \"boolean\"}, \"DhcpProfile\": {\"description\": \"This is the name or UUID of the NSX DHCP Profile that will be used to enable native DHCP service.\", \"type\": \"string\"}, \"MetadataProxy\": {\"description\": \"This is the name or UUID of the NSX Metadata Proxy that will be used to enable native metadata service.\", \"type\": \"string\"}, \"DhcpRelayService\": {\"default\": \"\", \"description\": \"This is the name or UUID of the NSX relay service that will be used to enable DHCP relay on router ports.\", \"type\": \"string\"}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron NSX Plugin role.\", \"value\": {\"service_name\": \"neutron_plugin_nsx\", \"config_settings\": {\"neutron::plugins::nsx::default_overlay_tz\": {\"get_param\": \"DefaultOverlayTz\"}, \"neutron::plugins::nsx::default_vlan_tz\": {\"get_param\": \"DefaultVlanTz\"}, \"neutron::plugins::nsx::default_bridge_cluster\": {\"get_param\": \"DefaultBridgeCluster\"}, \"neutron::plugins::nsx::default_tier0_router\": {\"get_param\": \"DefaultTier0Router\"}, \"neutron::plugins::nsx::nsx_api_managers\": {\"get_param\": \"NsxApiManagers\"}, \"neutron::plugins::nsx::nsx_api_user\": {\"get_param\": \"NsxApiUser\"}, \"neutron::plugins::nsx::nsx_api_password\": {\"get_param\": \"NsxApiPassword\"}, \"neutron::plugins::nsx::native_dhcp_metadata\": {\"get_param\": \"NativeDhcpMetadata\"}, \"neutron::plugins::nsx::dhcp_profile\": {\"get_param\": \"DhcpProfile\"}, \"neutron::plugins::nsx::dhcp_relay_service\": {\"get_param\": \"DhcpRelayService\"}, \"neutron::plugins::nsx::metadata_proxy\": {\"get_param\": \"MetadataProxy\"}}, \"service_config_settings\": {}, \"metadata_settings\": {}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": {\"get_param\": \"NeutronPluginNsxPuppetTags\"}, \"step_config\": {\"get_attr\": \"include tripleo::profile::base::neutron::plugins::nsx\\n\"}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {}, \"docker_config\": {}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/ovn/ovn-dbs-cluster-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized OVN DBs service in cluster mode\\n\", \"parameters\": {\"ContainerOvnNbDbImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOvnSbDbImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOvnNorthdImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNeutronApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOvnMetadataImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry.  This mapping overrides those in ServiceNetMapDefaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"OVNOvsdbProbeInterval\": {\"description\": \"Probe interval in ms for the OVSDB session\", \"type\": \"number\", \"default\": 60000}, \"OVNNorthboundServerPort\": {\"description\": \"Port of the OVN Northbound DB server\", \"type\": \"number\", \"default\": 6641}, \"OVNSouthboundServerPort\": {\"description\": \"Port of the OVN Southbound DB server\", \"type\": \"number\", \"default\": 6642}, \"OVNNorthboundClusterPort\": {\"description\": \"Cluster port of the OVN Northbound DB server\", \"type\": \"number\", \"default\": 6643}, \"OVNSouthboundClusterPort\": {\"description\": \"Cluster port of the OVN Southbound DB server\", \"type\": \"number\", \"default\": 6644}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"OvnDBSCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"conditions\": {\"key_size_override_unset\": {\"equals\": [{\"get_param\": \"OvnDBSCertificateKeySize\"}, \"\"]}, \"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}]}, 6]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerOvnNbDbImage\": \"ContainerOvnNbDbImage\", \"ContainerOvnSbDbImage\": \"ContainerOvnSbDbImage\", \"ContainerOvnNorthdImage\": \"ContainerOvnNorthdImage\", \"ContainerNeutronApiImage\": \"ContainerNeutronApiImage\", \"ContainerOvnMetadataImage\": \"ContainerOvnMetadataImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerOvnNbDbImage\": {\"get_param\": \"ContainerOvnNbDbImage\"}, \"ContainerOvnSbDbImage\": {\"get_param\": \"ContainerOvnSbDbImage\"}, \"ContainerOvnNorthdImage\": {\"get_param\": \"ContainerOvnNorthdImage\"}, \"ContainerNeutronApiImage\": {\"get_param\": \"ContainerNeutronApiImage\"}, \"ContainerOvnMetadataImage\": {\"get_param\": \"ContainerOvnMetadataImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the OVN multi-active cluster role.\", \"value\": {\"service_name\": \"ovn_dbs\", \"firewall_rules\": {\"map_merge\": {\"repeat\": {\"for_each\": {\"<%net_cidr%>\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}]}}, \"template\": {\"121 OVN DB server and cluster ports for <%net_cidr%>\": {\"proto\": \"tcp\", \"source\": \"<%net_cidr%>\", \"dport\": [{\"get_param\": \"OVNNorthboundServerPort\"}, {\"get_param\": \"OVNSouthboundServerPort\"}, {\"get_param\": \"OVNNorthboundClusterPort\"}, {\"get_param\": \"OVNSouthboundClusterPort\"}]}}}}}, \"kolla_config\": {\"/var/lib/kolla/config_files/ovn_cluster_north_db_server.json\": {\"command\": \"bash -c $* -- eval source /etc/sysconfig/ovn_cluster; exec /usr/local/bin/start-nb-db-server ${OVN_NB_DB_OPTS}\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/openvswitch\", \"owner\": \"root:root\", \"recurse\": true}, {\"path\": \"/var/log/ovn\", \"owner\": \"root:root\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/ovn_cluster_south_db_server.json\": {\"command\": \"bash -c $* -- eval source /etc/sysconfig/ovn_cluster; exec /usr/local/bin/start-sb-db-server ${OVN_SB_DB_OPTS}\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/openvswitch\", \"owner\": \"root:root\", \"recurse\": true}, {\"path\": \"/var/log/ovn\", \"owner\": \"root:root\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/ovn_cluster_northd.json\": {\"command\": \"bash -c $* -- eval source /etc/sysconfig/ovn_cluster; exec /usr/bin/ovn-northd ${OVN_NORTHD_OPTS}\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/openvswitch\", \"owner\": \"root:root\", \"recurse\": true}, {\"path\": \"/var/log/ovn\", \"owner\": \"root:root\", \"recurse\": true}]}}, \"docker_config\": {\"step_0\": {\"ovn_cluster_north_db_server\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnNbDbImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ovn_cluster_north_db_server.json:/var/lib/kolla/config_files/config.json:ro\", \"/lib/modules:/lib/modules:ro\", \"/var/lib/openvswitch/ovn:/var/lib/openvswitch:shared,z\", \"/var/lib/openvswitch/ovn:/run/openvswitch:shared,z\", \"/var/log/containers/openvswitch:/var/log/openvswitch:z\", \"/var/lib/openvswitch/ovn:/var/lib/ovn:shared,z\", \"/var/lib/openvswitch/ovn:/etc/openvswitch:shared,z\", \"/var/lib/openvswitch/ovn:/etc/ovn:shared,z\", \"/var/lib/openvswitch/ovn:/run/ovn:shared,z\", \"/var/log/containers/openvswitch:/var/log/ovn:z\", \"/var/lib/config-data/ansible-generated/ovn:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/private/ovn_dbs.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_dbs.key:ro\", \"/etc/pki/tls/certs/ovn_dbs.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_dbs.crt:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"ovn_cluster_south_db_server\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnSbDbImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ovn_cluster_south_db_server.json:/var/lib/kolla/config_files/config.json:ro\", \"/lib/modules:/lib/modules:ro\", \"/var/lib/openvswitch/ovn:/var/lib/openvswitch:shared,z\", \"/var/lib/openvswitch/ovn:/run/openvswitch:shared,z\", \"/var/log/containers/openvswitch:/var/log/openvswitch:z\", \"/var/lib/openvswitch/ovn:/var/lib/ovn:shared,z\", \"/var/lib/openvswitch/ovn:/etc/openvswitch:shared,z\", \"/var/lib/openvswitch/ovn:/etc/ovn:shared,z\", \"/var/lib/openvswitch/ovn:/run/ovn:shared,z\", \"/var/log/containers/openvswitch:/var/log/ovn:z\", \"/var/lib/config-data/ansible-generated/ovn:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/private/ovn_dbs.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_dbs.key:ro\", \"/etc/pki/tls/certs/ovn_dbs.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_dbs.crt:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"ovn_cluster_northd\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnNorthdImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ovn_cluster_northd.json:/var/lib/kolla/config_files/config.json:ro\", \"/lib/modules:/lib/modules:ro\", \"/var/lib/openvswitch/ovn:/run/openvswitch:shared,z\", \"/var/log/containers/openvswitch:/var/log/openvswitch:z\", \"/var/lib/openvswitch/ovn:/run/ovn:shared,z\", \"/var/log/containers/openvswitch:/var/log/ovn:z\", \"/var/lib/config-data/ansible-generated/ovn:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/private/ovn_dbs.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_dbs.key:ro\", \"/etc/pki/tls/certs/ovn_dbs.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_dbs.crt:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"global_config_settings\": {\"ovn_db_clustered\": true}, \"metadata_settings\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"service\": \"ovn_dbs\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"type\": \"node\"}], null]}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"loop\": [{\"path\": \"/var/log/containers/openvswitch\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/openvswitch/ovn\", \"setype\": \"container_file_t\"}]}], \"deploy_steps_tasks\": [{\"name\": \"set is_ovn_dbs_bootstrap_node fact\", \"set_fact\": \"is_ovn_dbs_bootstrap_node={{ovn_dbs_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\", \"when\": [\"step|int == 1\"]}, {\"name\": \"Populate ansible service facts so we can check for pacemaker service\", \"ansible.builtin.service_facts\": null, \"when\": [\"is_ovn_dbs_bootstrap_node | bool\", \"step|int == 1\"]}, {\"name\": \"Remove OVNDBs from Pacemaker\", \"when\": [\"step|int == 1\", \"is_ovn_dbs_bootstrap_node | bool\", \"ansible_facts['services']['pacemaker.service']['state']  | default('unknown') == 'running'\"], \"block\": [{\"name\": \"Fetch ovn-dbs-bundle\", \"shell\": \"pcs status |grep ovn-dbs-bundle ||true\\n\", \"register\": \"ovn_dbs\"}, {\"name\": \"Fetch ovn VIP\", \"shell\": \"pcs constraint config |grep \\\"with ovn-dbs-bundle\\\" |awk '{print $1}'\\n\", \"register\": \"ovn_vip\"}, {\"name\": \"Remove OVNDBs from pacemaker\", \"pacemaker_resource\": {\"resource\": \"ovn-dbs-bundle\", \"state\": \"delete\"}, \"when\": \"ovn_dbs.stdout |length  > 0\"}, {\"name\": \"Remove OVNDBs VIP from pacemaker\", \"pacemaker_resource\": {\"resource\": \"{{ ovn_vip.stdout }}\", \"state\": \"delete\"}, \"when\": \"ovn_vip.stdout |length > 0\"}, {\"name\": \"Clean up pacemaker remote nodes cache\", \"shell\": \"pcs cluster node clear ovn-dbs-bundle-0\\npcs cluster node clear ovn-dbs-bundle-1\\npcs cluster node clear ovn-dbs-bundle-2\\ncrm_attribute --name OVN_REPL_INFO --delete\\n\"}, {\"name\": \"Remove pacemaker attributes\", \"shell\": \"pcs node attribute \\\"{{ item }}\\\" ovn-dbs-role= || true\\n\", \"loop\": \"{{ ovn_dbs_short_node_names }}\"}]}, {\"name\": \"Prepare OVN cluster\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Certificate generation\", \"when\": \"enable_internal_tls | bool\", \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"ovn_dbs\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"ovn_dbs/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"OvnDBSCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}, {\"block\": [{\"name\": \"Configure OVN DBs and northd\", \"include_role\": {\"name\": \"tripleo_ovn_cluster\"}, \"vars\": {\"tripleo_ovn_cluster_dbs_protocol\": \"{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}\", \"tripleo_ovn_cluster_network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"tripleo_ovn_cluster_nb_db_port\": {\"get_param\": \"OVNNorthboundServerPort\"}, \"tripleo_ovn_cluster_sb_db_port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"tripleo_ovn_cluster_nb_local_port\": {\"get_param\": \"OVNNorthboundClusterPort\"}, \"tripleo_ovn_cluster_nb_remote_port\": {\"get_param\": \"OVNNorthboundClusterPort\"}, \"tripleo_ovn_cluster_sb_local_port\": {\"get_param\": \"OVNSouthboundClusterPort\"}, \"tripleo_ovn_cluster_sb_remote_port\": {\"get_param\": \"OVNSouthboundClusterPort\"}, \"tripleo_ovn_cluster_northd_ssl_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo_ovn_cluster_sb_ssl_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo_ovn_cluster_nb_ssl_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}}}]}]}, {\"name\": \"Start OVN DBs and northd containers (bootstrap node)\", \"when\": [\"step|int == 3\", \"is_ovn_dbs_bootstrap_node | bool\"], \"block\": [{\"block\": [{\"name\": \"Start OVN container\", \"include_role\": {\"name\": \"tripleo_container_manage\"}, \"vars\": {\"tripleo_container_manage_config\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"tripleo_container_manage_config_id\": \"{{ ovn_container }}\", \"tripleo_container_manage_config_patterns\": \"{{ ovn_container }}.json\"}, \"loop\": [\"ovn_cluster_north_db_server\", \"ovn_cluster_south_db_server\", \"ovn_cluster_northd\"], \"loop_control\": {\"loop_var\": \"ovn_container\"}}]}, {\"name\": \"Set NB connection\", \"become\": true, \"shell\": \"podman exec ovn_cluster_north_db_server bash -c \\\"ovn-nbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_nb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\\\"\\n\", \"register\": \"nb_result\", \"retries\": 20, \"delay\": 5, \"until\": \"nb_result.rc == 0\", \"when\": [\"is_ovn_dbs_bootstrap_node | bool\"], \"vars\": {\"tripleo_ovn_cluster_network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"tripleo_ovn_cluster_nb_db_port\": {\"get_param\": \"OVNNorthboundServerPort\"}, \"tripleo_ovn_cluster_dbs_protocol\": \"{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}\", \"tripleo_ovn_cluster_dbs_addr\": {\"if\": [\"is_ipv6\", \"[::]\", \"0.0.0.0\"]}, \"tripleo_ovn_cluster_probe_interval\": {\"get_param\": \"OVNOvsdbProbeInterval\"}}}, {\"name\": \"Set SB connection\", \"become\": true, \"shell\": \"podman exec ovn_cluster_south_db_server bash -c \\\"ovn-sbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_sb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\\\"\\n\", \"register\": \"sb_result\", \"retries\": 20, \"delay\": 5, \"until\": \"sb_result.rc == 0\", \"when\": [\"is_ovn_dbs_bootstrap_node | bool\"], \"vars\": {\"tripleo_ovn_cluster_network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"tripleo_ovn_cluster_sb_db_port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"tripleo_ovn_cluster_dbs_protocol\": \"{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}\", \"tripleo_ovn_cluster_dbs_addr\": {\"if\": [\"is_ipv6\", \"[::]\", \"0.0.0.0\"]}, \"tripleo_ovn_cluster_probe_interval\": {\"get_param\": \"OVNOvsdbProbeInterval\"}}}]}, {\"name\": \"Start OVN DBs and northd containers (non-bootstrap nodes)\", \"when\": [\"step|int == 4\", \"not is_ovn_dbs_bootstrap_node | bool\"], \"block\": [{\"block\": [{\"name\": \"Start OVN container\", \"include_role\": {\"name\": \"tripleo_container_manage\"}, \"vars\": {\"tripleo_container_manage_config\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"tripleo_container_manage_config_id\": \"{{ ovn_container }}\", \"tripleo_container_manage_config_patterns\": \"{{ ovn_container }}.json\"}, \"loop\": [\"ovn_cluster_north_db_server\", \"ovn_cluster_south_db_server\", \"ovn_cluster_northd\"], \"loop_control\": {\"loop_var\": \"ovn_container\"}}]}, {\"name\": \"Set NB connection\", \"become\": true, \"shell\": \"podman exec ovn_cluster_north_db_server bash -c \\\"ovn-nbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_nb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\\\"\\n\", \"register\": \"nb_result\", \"retries\": 20, \"delay\": 5, \"until\": \"nb_result.rc == 0\", \"when\": [\"is_ovn_dbs_bootstrap_node | bool\"], \"vars\": {\"tripleo_ovn_cluster_network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"tripleo_ovn_cluster_nb_db_port\": {\"get_param\": \"OVNNorthboundServerPort\"}, \"tripleo_ovn_cluster_dbs_protocol\": \"{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}\", \"tripleo_ovn_cluster_dbs_addr\": {\"if\": [\"is_ipv6\", \"[::]\", \"0.0.0.0\"]}, \"tripleo_ovn_cluster_probe_interval\": {\"get_param\": \"OVNOvsdbProbeInterval\"}}}, {\"name\": \"Set SB connection\", \"become\": true, \"shell\": \"podman exec ovn_cluster_south_db_server bash -c \\\"ovn-sbctl --no-leader-only --inactivity-probe={{ tripleo_ovn_cluster_probe_interval }} set-connection p{{ tripleo_ovn_cluster_dbs_protocol }}:{{ tripleo_ovn_cluster_sb_db_port }}:{{ tripleo_ovn_cluster_dbs_addr }}\\\"\\n\", \"register\": \"sb_result\", \"retries\": 20, \"delay\": 5, \"until\": \"sb_result.rc == 0\", \"when\": [\"is_ovn_dbs_bootstrap_node | bool\"], \"vars\": {\"tripleo_ovn_cluster_network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"tripleo_ovn_cluster_sb_db_port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"tripleo_ovn_cluster_dbs_protocol\": \"{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}\", \"tripleo_ovn_cluster_dbs_addr\": {\"if\": [\"is_ipv6\", \"[::]\", \"0.0.0.0\"]}, \"tripleo_ovn_cluster_probe_interval\": {\"get_param\": \"OVNOvsdbProbeInterval\"}}}]}], \"external_update_tasks\": [{\"name\": \"Run ovndbs update\", \"tags\": [\"ovn\", \"ovn_image\"], \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Get OVN_Northbound cluster leader\", \"become\": true, \"shell\": \"podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl cluster/status OVN_Northbound | grep 'Leader: '\\n\", \"register\": \"ovn_nb_dbs_cluster_leader\", \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}\", \"delegate_to\": \"{{ item }}\"}, {\"set_fact\": {\"ovn_nb_leader\": \"{{ ovn_nb_dbs_cluster_leader| json_query(\\\"results[?contains(stdout,'Leader: self')].item\\\") }}\"}}, {\"name\": \"Graceful stop OVN NB leader container\", \"delegate_to\": \"{{ ovn_nb_leader[0] }}\", \"become\": true, \"shell\": \"podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl exit\\n\"}, {\"name\": \"Start OVN NB leader container\", \"delegate_to\": \"{{ ovn_nb_leader[0] }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_north_db_server\"], \"config_patterns\": \"*ovn_cluster_north_db_server.json\", \"config_overrides\": {\".*ovn_cluster_north_db_server\": {\"image\": {\"get_param\": \"ContainerOvnNbDbImage\"}, \"name\": \"ovn_cluster_north_db_server\"}}}}, {\"name\": \"Get OVN_Southbound cluster leader\", \"become\": true, \"shell\": \"sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl cluster/status OVN_Southbound | grep 'Leader: '\\n\", \"register\": \"ovn_sb_dbs_cluster_leader\", \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}\", \"delegate_to\": \"{{ item }}\"}, {\"set_fact\": {\"ovn_sb_leader\": \"{{ ovn_sb_dbs_cluster_leader | json_query(\\\"results[?contains(stdout,'Leader: self')].item\\\") }}\"}}, {\"name\": \"Graceful stop OVN SB leader container\", \"delegate_to\": \"{{ ovn_sb_leader[0] }}\", \"become\": true, \"shell\": \"sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl exit\\n\"}, {\"name\": \"Start OVN SB leader container\", \"delegate_to\": \"{{ ovn_sb_leader[0] }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_south_db_server\"], \"config_patterns\": \"*ovn_cluster_south_db_server.json\", \"config_overrides\": {\".*ovn_cluster_south_db_server\": {\"image\": {\"get_param\": \"ContainerOvnSbDbImage\"}, \"name\": \"ovn_cluster_south_db_server\"}}}}, {\"name\": \"Loop on OVN_Northbound cluster for leader election\", \"become\": true, \"shell\": \"podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl cluster/status OVN_Northbound | grep 'Leader: '\\n\", \"register\": \"wait_leader\", \"delegate_to\": \"{{ groups['ovn_dbs'] | difference(groups['excluded_overcloud']) |  difference(ovn_nb_leader[0]) | first }}\", \"failed_when\": \"'Leader: unknown' in wait_leader.stdout or wait_leader.stderr != ''\", \"until\": \"'Leader: unknown' not in wait_leader.stdout and wait_leader.stderr == ''\", \"retries\": 10, \"delay\": 5}, {\"name\": \"Loop on OVN_Southbound cluster for leader election\", \"become\": true, \"shell\": \"podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl cluster/status OVN_Southbound | grep 'Leader: '\\n\", \"register\": \"wait_leader\", \"delegate_to\": \"{{ groups['ovn_dbs'] | difference(groups['excluded_overcloud']) |  difference(ovn_nb_leader[0]) | first }}\", \"failed_when\": \"'Leader: unknown' in wait_leader.stdout or wait_leader.stderr != ''\", \"until\": \"'Leader: unknown' not in wait_leader.stdout and wait_leader.stderr == ''\", \"retries\": 10, \"delay\": 5}, {\"name\": \"Pause for 30 seconds to ensure ovn db leader knows it was elected and clients reconnect\", \"wait_for\": {\"timeout\": 30}}, {\"name\": \"Get OVN_Northbound cluster new leader\", \"become\": true, \"shell\": \"podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl cluster/status OVN_Northbound | grep 'Leader: '\\n\", \"register\": \"ovn_nb_dbs_cluster_leader_new\", \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}\", \"until\": \"'Leader: unknown' not in ovn_nb_dbs_cluster_leader_new.stdout\", \"retries\": 10, \"delay\": 5, \"delegate_to\": \"{{ item }}\"}, {\"set_fact\": {\"ovn_nb_leader_new\": \"{{ ovn_nb_dbs_cluster_leader_new| json_query(\\\"results[?contains(stdout,'Leader: self')].item\\\") }}\"}}, {\"name\": \"Get OVN_Southbound cluster new leader\", \"become\": true, \"shell\": \"sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl cluster/status OVN_Southbound | grep 'Leader: '\\n\", \"register\": \"ovn_sb_dbs_cluster_leader_new\", \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) }}\", \"until\": \"'Leader: unknown' not in ovn_sb_dbs_cluster_leader_new.stdout\", \"retries\": 10, \"delay\": 5, \"delegate_to\": \"{{ item }}\"}, {\"set_fact\": {\"ovn_sb_leader_new\": \"{{ ovn_sb_dbs_cluster_leader_new | json_query(\\\"results[?contains(stdout,'Leader: self')].item\\\") }}\"}}, {\"name\": \"Start OVN NB containers (non-leader nodes)\", \"delegate_to\": \"{{ item }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_north_db_server\"], \"config_patterns\": \"*ovn_cluster_north_db_server.json\", \"config_overrides\": {\".*ovn_cluster_north_db_server\": {\"image\": {\"get_param\": \"ContainerOvnNbDbImage\"}, \"name\": \"ovn_cluster_north_db_server\"}}}, \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) | difference(ovn_nb_leader[0])| difference(ovn_nb_leader_new[0])}}\", \"loop_control\": {\"pause\": 15}}, {\"name\": \"Start OVN SB containers (non-leader nodes)\", \"delegate_to\": \"{{ item }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_south_db_server\"], \"config_patterns\": \"*ovn_cluster_south_db_server.json\", \"config_overrides\": {\".*ovn_cluster_south_db_server\": {\"image\": {\"get_param\": \"ContainerOvnSbDbImage\"}, \"name\": \"ovn_cluster_south_db_server\"}}}, \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud']) | difference(ovn_sb_leader[0])| difference(ovn_sb_leader_new[0])}}\", \"loop_control\": {\"pause\": 15}}, {\"name\": \"Pause for 50 seconds before restarting new leaders of OVN\", \"wait_for\": {\"timeout\": 50}}, {\"name\": \"Graceful stop OVN NB new-leader container\", \"delegate_to\": \"{{ ovn_nb_leader_new[0] }}\", \"become\": true, \"shell\": \"podman exec -u root ovn_cluster_north_db_server ovs-appctl -t /var/run/ovn/ovnnb_db.ctl exit\\n\", \"when\": \"ovn_nb_leader_new[0] != ovn_nb_leader[0]\"}, {\"name\": \"Start OVN NB containers (new-leader nodes)\", \"delegate_to\": \"{{ ovn_nb_leader_new[0] }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_north_db_server\"], \"config_patterns\": \"*ovn_cluster_north_db_server.json\", \"config_overrides\": {\".*ovn_cluster_north_db_server\": {\"image\": {\"get_param\": \"ContainerOvnNbDbImage\"}, \"name\": \"ovn_cluster_north_db_server\"}}}, \"when\": \"ovn_nb_leader_new[0] != ovn_nb_leader[0]\"}, {\"name\": \"Graceful stop OVN SB new-leader container\", \"delegate_to\": \"{{ ovn_sb_leader_new[0] }}\", \"become\": true, \"shell\": \"sudo podman exec -u root ovn_cluster_south_db_server ovs-appctl -t /var/run/ovn/ovnsb_db.ctl exit\\n\", \"when\": \"ovn_sb_leader_new[0] != ovn_sb_leader[0]\"}, {\"name\": \"Start OVN SB containers (new-leader nodes)\", \"delegate_to\": \"{{ ovn_sb_leader_new[0] }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_south_db_server\"], \"config_patterns\": \"*ovn_cluster_south_db_server.json\", \"config_overrides\": {\".*ovn_cluster_south_db_server\": {\"image\": {\"get_param\": \"ContainerOvnSbDbImage\"}, \"name\": \"ovn_cluster_south_db_server\"}}}, \"when\": \"ovn_sb_leader_new[0] != ovn_sb_leader[0]\"}, {\"name\": \"Start OVN northd container\", \"delegate_to\": \"{{ item }}\", \"become\": true, \"tripleo_container_manage\": {\"config_dir\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"config_id\": [\"ovn_cluster_northd\"], \"config_patterns\": \"*ovn_cluster_northd.json\", \"config_overrides\": {\".*ovn_cluster_northd\": {\"image\": {\"get_param\": \"ContainerOvnNorthdImage\"}, \"name\": \"ovn_cluster_northd\"}}}, \"loop\": \"{{groups['ovn_dbs'] | difference(groups['excluded_overcloud'])}}\", \"loop_control\": {\"pause\": 15}}]}], \"update_tasks\": [{\"name\": \"Configure OVN cluster during update\", \"when\": \"step|int == 4\", \"block\": [{\"name\": \"Configure OVN DBs and northd\", \"include_role\": {\"name\": \"tripleo_ovn_cluster\"}, \"vars\": {\"tripleo_ovn_cluster_dbs_protocol\": \"{{ enable_internal_tls | ternary('ssl', 'tcp', 'tcp') }}\", \"tripleo_ovn_cluster_network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"tripleo_ovn_cluster_nb_db_port\": {\"get_param\": \"OVNNorthboundServerPort\"}, \"tripleo_ovn_cluster_sb_db_port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"tripleo_ovn_cluster_nb_local_port\": {\"get_param\": \"OVNNorthboundClusterPort\"}, \"tripleo_ovn_cluster_nb_remote_port\": {\"get_param\": \"OVNNorthboundClusterPort\"}, \"tripleo_ovn_cluster_sb_local_port\": {\"get_param\": \"OVNSouthboundClusterPort\"}, \"tripleo_ovn_cluster_sb_remote_port\": {\"get_param\": \"OVNSouthboundClusterPort\"}, \"tripleo_ovn_cluster_northd_ssl_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo_ovn_cluster_sb_ssl_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo_ovn_cluster_nb_ssl_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}}}]}, {\"name\": \"Update OVN cluster containers\", \"when\": \"step|int == 4\", \"block\": [{\"name\": \"Start OVN container\", \"include_role\": {\"name\": \"tripleo_container_manage\"}, \"vars\": {\"tripleo_container_manage_config\": \"/var/lib/tripleo-config/container-startup-config/step_0\", \"tripleo_container_manage_config_id\": \"{{ ovn_container }}\", \"tripleo_container_manage_config_patterns\": \"{{ ovn_container }}.json\"}, \"loop\": [\"ovn_cluster_north_db_server\", \"ovn_cluster_south_db_server\", \"ovn_cluster_northd\"], \"loop_control\": {\"loop_var\": \"ovn_container\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-cleanup": "#!/usr/bin/bash\n# Cleanup neutron OVS bridges. To be called on startup to avoid\n# \"difficult-to-debug\" issues with partially configured resources.\n\nNEUTRON_OVS_CONF=/var/lib/config-data/puppet-generated/neutron/etc/neutron/plugins/ml2/openvswitch_agent.ini\n\nif [ -e ${NEUTRON_OVS_CONF} ];\nthen\n    INT_BRIDGE=`crudini --get ${NEUTRON_OVS_CONF} ovs integration_bridge`\n    TUN_BRIDGE=`crudini --get ${NEUTRON_OVS_CONF} ovs tunnel_bridge`\nfi\n\nfor port in `ovs-vsctl list-ports ${INT_BRIDGE:-\"br-int\"}`;\ndo\n    skip_cleanup=`ovs-vsctl --if-exists get Interface $port external_ids:skip_cleanup`\n    if ! [[ \"x$skip_cleanup\" == \"x\\\"true\\\"\" ]];\n    then\n        ovs-vsctl del-port ${INT_BRIDGE:-\"br-int\"} $port\n    fi\ndone\n\novs-vsctl --if-exists del-br ${TUN_BRIDGE:-\"br-tun\"}\n\n# Clean up trunk port bridges\nfor br in $(ovs-vsctl list-br | egrep 'tbr-[0-9a-f\\-]+'); do\n    ovs-vsctl --if-exists del-br $br\ndone\n", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-cleanup.service": "[Unit]\nDescription=Neutron cleanup on startup\nAfter=openvswitch.service network.target\nBefore=tripleo_neutron_ovs_agent.service tripleo_neutron_dhcp.service tripleo_neutron_l3_agent.service tripleo_nova_compute.service\nRefuseManualStop=yes\n\n[Service]\nType=oneshot\nExecStart=/usr/libexec/neutron-cleanup\n\n[Install]\nWantedBy=multi-user.target\n", "file:///root/tripleo-heat-installer-templates/deployment/ovn/ovn-controller-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Ovn Controller agent.\\n\", \"parameters\": {\"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ContainerOvnControllerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOvnControllerConfigImage\": {\"description\": \"The container image to use for the ovn_controller config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"OVNSouthboundServerPort\": {\"description\": \"Port of the Southbound DB Server\", \"type\": \"number\", \"default\": 6642}, \"NeutronBridgeMappings\": {\"description\": \"The OVS logical->physical bridge mappings to use. See the Neutron documentation for details. Defaults to mapping br-ex - the external bridge on hosts - to a physical name 'datacentre' which can be used to create provider networks (and we use this for the default floating network) - if changing this either use different post-install network scripts or be sure to keep 'datacentre' as a mapping network name.\\n\", \"type\": \"comma_delimited_list\", \"default\": \"datacentre:br-ex\", \"tags\": [\"role_specific\"]}, \"EnableVLANTransparency\": {\"default\": false, \"description\": \"If True, then allow plugins that support it to create VLAN transparent networks.\\n\", \"type\": \"boolean\"}, \"OVNEncapType\": {\"description\": \"Type of encapsulation used in OVN. It can be \\\"geneve\\\" or \\\"vxlan\\\".\\n\", \"type\": \"string\", \"default\": \"geneve\", \"constraints\": [{\"allowed_values\": [\"geneve\", \"vxlan\"]}]}, \"OVNIntegrationBridge\": {\"description\": \"Name of the OVS bridge to use as integration bridge by OVN Controller.\\n\", \"type\": \"string\", \"default\": \"br-int\"}, \"OVNMetadataEnabled\": {\"description\": \"Whether Metadata Service has to be enabled\", \"type\": \"boolean\", \"default\": true}, \"OVNAvailabilityZone\": {\"description\": \"The az options to configure in ovs db. eg. ['az-0', 'az-1', 'az-2']\", \"type\": \"comma_delimited_list\", \"default\": [], \"tags\": [\"role_specific\"]}, \"OVNCMSOptions\": {\"description\": \"The CMS options to configure in ovs db\", \"type\": \"string\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"OVNEncapTos\": {\"description\": \"The value to be applied to OVN tunnel interface's option:tos as specified in the Open_vSwitch database Interface table. This feature is supported from OVN v21.12.0.\\n\", \"type\": \"string\", \"default\": \"0\", \"tags\": [\"role_specific\"]}, \"OvsHwOffload\": {\"default\": false, \"description\": \"Enable OVS Hardware Offload. This feature supported from OVS 2.8.0\\n\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"OVNRemoteProbeInterval\": {\"description\": \"Probe interval in ms\", \"type\": \"number\", \"default\": 60000}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"OVNOpenflowProbeInterval\": {\"description\": \"The inactivity probe interval of the OpenFlow connection to the OpenvSwitch integration bridge, in seconds.\\n\", \"type\": \"number\", \"default\": 60}, \"OVNOfctrlWaitBeforeClear\": {\"description\": \"Sets the time ovn-controller will wait on startup before clearing all openflow rules and installing the new ones, in ms.\\n\", \"type\": \"number\", \"default\": 8000}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"ContainerOvnCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"OVNContainerCpusetCpus\": {\"description\": \"Limit the specific CPUs or cores a container can use. It can be specified as a single core (ex. 0), as a comma-separated list (ex. 0,1), as a range (ex. 0-3) or a combination if previous methods (ex 0-3,7,11-15).  The selected cores should be isolated from guests and hypervisor in order to obtain best possible performance.\\n\", \"type\": \"string\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"OVNStaticBridgeMacMappings\": {\"type\": \"json\", \"default\": {}, \"description\": \"Static OVN Bridge MAC address mappings. Unique OVN bridge mac addresses\\nis dynamically allocated by creating neutron ports. When neutron isn't\\navailable, for instance in the standalone deployment, use this parameter\\nto provide static OVN bridge mac addresses. For example:\\n   controller-0:\\n     datacenter: 00:00:5E:00:53:00\\n     provider: 00:00:5E:00:53:01\\n   compute-0:\\n     datacenter: 00:00:5E:00:54:00\\n     provider: 00:00:5E:00:54:01\\n\", \"tags\": [\"role_specific\"]}, \"AuthCloudName\": {\"description\": \"Entry in clouds.yaml to use for authentication\", \"type\": \"string\", \"default\": \"\"}, \"OVNControllerImageUpdateTimeout\": {\"description\": \"During update, how long we wait for the container image to be updated, in seconds.\\n\", \"type\": \"number\", \"default\": 600}, \"OVNControllerUpdateTimeout\": {\"description\": \"During update, how long we wait for the container to be updated, in seconds.\\n\", \"type\": \"number\", \"default\": 600}, \"OVNControllerGarpMaxTimeout\": {\"description\": \"When used, this configuration value specifies the maximum timeout (in seconds) between two consecutive GARP packets sent by ovn-controller.\\n\", \"type\": \"number\", \"default\": 0}}, \"conditions\": {\"force_config_drive\": {\"equals\": [{\"get_param\": \"OVNMetadataEnabled\"}, false]}, \"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"ContainerOvnCertificateKeySize\"}, \"\"]}, \"enable_vlan_transparency\": {\"equals\": [{\"get_param\": \"EnableVLANTransparency\"}, true]}, \"auth_cloud_name_set\": {\"not\": {\"equals\": [{\"get_param\": \"AuthCloudName\"}, \"\"]}}, \"ovn_cpu_set\": {\"or\": [{\"not\": {\"equals\": [{\"get_param\": \"OVNContainerCpusetCpus\"}, \"\"]}}, {\"not\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"OVNContainerCpusetCpus\"]}, \"\"]}}]}, \"key_size_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"ContainerOvnCertificateKeySize\"}, \"\"]}}, \"az_ovn_unset\": {\"and\": [{\"equals\": [{\"get_param\": \"OVNAvailabilityZone\"}, []]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"OVNAvailabilityZone\"]}, \"\"]}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ovn::controller::ovn_bridge_mappings\": \"NeutronBridgeMappings\", \"ovn::controller::ovn_cms_options\": {\"if\": [\"az_ovn_unset\", \"OVNCMSOptions\", \"OVNCMSOptionsMerged\"]}, \"ovn::controller::ovn_encap_tos\": \"OVNEncapTos\", \"vswitch::ovs::enable_hw_offload\": \"OvsHwOffload\", \"container_cpuset_cpus\": \"OVNContainerCpusetCpus\", \"ContainerOvnControllerImage\": \"ContainerOvnControllerImage\", \"ContainerOvnControllerConfigImage\": \"ContainerOvnControllerConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NeutronBridgeMappings\": {\"get_param\": \"NeutronBridgeMappings\"}, \"OVNCMSOptions\": {\"get_param\": \"OVNCMSOptions\"}, \"OVNCMSOptionsMerged\": {\"list_join\": [\"\", [{\"str_replace\": {\"template\": \"$OVNCMSOptions\", \"params\": {\"if\": [{\"not\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"OVNCMSOptions\"]}, \"\"]}}, {\"$OVNCMSOptions\": {\"get_param\": [\"RoleParameters\", \"OVNCMSOptions\"]}}, {\"$OVNCMSOptions\": {\"get_param\": \"OVNCMSOptions\"}}]}}}, {\"str_replace\": {\"template\": \",availability-zones=$OVNAvailabilityZone\", \"params\": {\"if\": [{\"not\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"OVNAvailabilityZone\"]}, \"\"]}}, {\"$OVNAvailabilityZone\": {\"get_param\": [\"RoleParameters\", \"OVNAvailabilityZone\"]}}, {\"$OVNAvailabilityZone\": {\"list_join\": [\",\", {\"get_param\": \"OVNAvailabilityZone\"}]}}]}}}]]}, \"OVNEncapTos\": {\"get_param\": \"OVNEncapTos\"}, \"OvsHwOffload\": {\"get_param\": \"OvsHwOffload\"}, \"OVNContainerCpusetCpus\": {\"get_param\": \"OVNContainerCpusetCpus\"}, \"ContainerOvnControllerImage\": {\"get_param\": \"ContainerOvnControllerImage\"}, \"ContainerOvnControllerConfigImage\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}}}]}}}, \"OVNBridgeMappingsValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ovn_bridge_mappings\": \"NeutronBridgeMappings\", \"ovn_static_bridge_mac_mappings\": \"OVNStaticBridgeMacMappings\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NeutronBridgeMappings\": {\"get_param\": \"NeutronBridgeMappings\"}, \"OVNStaticBridgeMacMappings\": {\"get_param\": \"OVNStaticBridgeMacMappings\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ovn Controller agent.\", \"value\": {\"service_name\": \"ovn_controller\", \"firewall_rules\": {\"118 neutron vxlan networks\": {\"proto\": \"udp\", \"dport\": 4789, \"state\": []}, \"119 neutron geneve networks\": {\"proto\": \"udp\", \"dport\": 6081, \"state\": []}, \"120 neutron geneve networks no conntrack\": {\"proto\": \"udp\", \"dport\": 6081, \"table\": \"raw\", \"chain\": \"OUTPUT\", \"jump\": \"NOTRACK\", \"action\": \"append\", \"state\": [\"INVALID\"]}, \"121 neutron geneve networks no conntrack\": {\"proto\": \"udp\", \"dport\": 6081, \"table\": \"raw\", \"chain\": \"PREROUTING\", \"jump\": \"NOTRACK\", \"action\": \"append\", \"state\": [\"INVALID\"]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"RoleParametersValue\", \"value\"]}, {\"ovn::southbound::port\": {\"get_param\": \"OVNSouthboundServerPort\"}, \"ovn::controller::ovn_encap_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronTenantNetwork\"]}}}}, \"ovn::controller::ovn_encap_type\": {\"get_param\": \"OVNEncapType\"}, \"ovn::controller::ovn_bridge\": {\"get_param\": \"OVNIntegrationBridge\"}, \"ovn::controller::hostname\": \"%{hiera('fqdn_canonical')}\", \"ovn::controller::ovn_remote_probe_interval\": {\"get_param\": \"OVNRemoteProbeInterval\"}, \"ovn::controller::ovn_openflow_probe_interval\": {\"get_param\": \"OVNOpenflowProbeInterval\"}, \"ovn::controller::ovn_ofctrl_wait_before_clear\": {\"get_param\": \"OVNOfctrlWaitBeforeClear\"}, \"ovn::controller::garp_max_timeout_sec\": {\"get_param\": \"OVNControllerGarpMaxTimeout\"}, \"ovn::controller::ovn_monitor_all\": true}, {\"if\": [\"force_config_drive\", {\"nova::compute::force_config_drive\": true}, {}]}, {\"if\": [\"internal_tls_enabled\", {\"tripleo::profile::base::neutron::agents::ovn::protocol\": \"ssl\"}, {}]}, {\"if\": [\"enable_vlan_transparency\", {\"vswitch::ovs::vlan_limit\": 0}, {}]}]}, \"service_config_settings\": {}, \"puppet_config\": {\"puppet_tags\": \"vs_config,exec\", \"config_volume\": \"ovn_controller\", \"step_config\": \"include tripleo::profile::base::neutron::agents::ovn\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnControllerConfigImage\"]}, \"volumes\": [\"/lib/modules:/lib/modules:ro\", \"/run/openvswitch:/run/openvswitch:shared,z\", \"/etc/sysconfig/modules:/etc/sysconfig/modules\"]}, \"kolla_config\": {\"/var/lib/kolla/config_files/ovn_controller.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/ovn-controller --pidfile --log-file unix:/run/openvswitch/db.sock\", {\"if\": [\"internal_tls_enabled\", {\"list_join\": [\" \", [\"-p /etc/pki/tls/private/ovn_controller.key -c /etc/pki/tls/certs/ovn_controller.crt -C\", {\"get_param\": \"InternalTLSCAFile\"}]]}, \"\"]}]]}, \"permissions\": [{\"path\": \"/var/log/openvswitch\", \"owner\": \"root:root\", \"recurse\": true}, {\"path\": \"/var/log/ovn\", \"owner\": \"root:root\", \"recurse\": true}]}}, \"metadata_settings\": {\"if\": [\"internal_tls_enabled\", [{\"service\": \"ovn_controller\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"type\": \"node\"}], null]}, \"docker_config\": {\"step_4\": {\"configure_cms_options\": {\"start_order\": 0, \"detach\": false, \"net\": \"host\", \"privileged\": true, \"user\": \"root\", \"command\": [\"/bin/bash\", \"-c\", \"CMS_OPTS=$(hiera ovn::controller::ovn_cms_options -c /etc/puppet/hiera.yaml);  if [ X\\\"$CMS_OPTS\\\" !=  X ]; then ovs-vsctl set open . external_ids:ovn-cms-options=$CMS_OPTS;else ovs-vsctl remove open . external_ids ovn-cms-options; fi\"], \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnControllerImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/lib/modules:/lib/modules:ro\", \"/run/openvswitch:/run/openvswitch:shared,z\"]]}, \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"ovn_controller\": {\"map_merge\": [{\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOvnControllerImage\"]}, \"net\": \"host\", \"privileged\": true, \"user\": \"root\", \"restart\": \"always\", \"depends_on\": [\"openvswitch.service\"]}, {\"if\": [\"ovn_cpu_set\", {\"cpuset_cpus\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"container_cpuset_cpus\"]}}]}, {\"healthcheck\": {\"test\": {\"list_join\": [\" \", [\"/openstack/healthcheck\", {\"yaql\": {\"expression\": \"str($.data.port)\", \"data\": {\"port\": {\"get_param\": \"OVNSouthboundServerPort\"}}}}]]}}, \"volumes\": {\"list_concat\": [[\"/var/lib/kolla/config_files/ovn_controller.json:/var/lib/kolla/config_files/config.json:ro\", \"/lib/modules:/lib/modules:ro\", \"/run:/run\", \"/var/lib/openvswitch/ovn:/run/ovn:shared,z\", \"/var/log/containers/openvswitch:/var/log/openvswitch:z\", \"/var/log/containers/openvswitch:/var/log/ovn:z\"], {\"if\": [\"internal_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"InternalTLSCAFile\"}, \"ro\"]]}, \"/etc/pki/tls/certs/ovn_controller.crt:/etc/pki/tls/certs/ovn_controller.crt\", \"/etc/pki/tls/private/ovn_controller.key:/etc/pki/tls/private/ovn_controller.key\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}]}}}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"ovn_controller\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"ovn_controller/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"ContainerOvnCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/openvswitch\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/openvswitch/ovn\", \"setype\": \"container_file_t\"}]}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}, {\"name\": \"Copy in cleanup script\", \"copy\": {\"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-cleanup\"}, \"dest\": \"/usr/libexec/neutron-cleanup\", \"force\": true, \"mode\": \"0755\"}}, {\"name\": \"Copy in cleanup service\", \"copy\": {\"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-cleanup.service\"}, \"dest\": \"/usr/lib/systemd/system/neutron-cleanup.service\", \"force\": true}}, {\"name\": \"Enabling the cleanup service\", \"service\": {\"name\": \"neutron-cleanup\", \"enabled\": true}, \"when\": \"not (ansible_check_mode|bool)\"}], \"external_deploy_tasks\": [{\"when\": [\"step|int == 0\"], \"name\": \"ovn_controller_external_deploy_init\", \"block\": [{\"name\": {\"str_replace\": {\"template\": \"create ovn mac address for $ROLE_NAME role nodes\", \"params\": {\"$ROLE_NAME\": {\"get_param\": \"RoleName\"}}}}, \"tripleo_ovn_mac_addresses\": {\"playbook_dir\": \"{{ playbook_dir }}\", \"stack_name\": {\"get_param\": \"RootStackName\"}, \"role_name\": {\"get_param\": \"RoleName\"}, \"server_resource_names\": {\"str_replace\": {\"template\": \"{{ groups[\\\"$ROLE_NAME\\\"] }}\", \"params\": {\"$ROLE_NAME\": {\"get_param\": \"RoleName\"}}}}, \"ovn_bridge_mappings\": {\"get_attr\": [\"OVNBridgeMappingsValue\", \"value\", \"ovn_bridge_mappings\"]}, \"ovn_static_bridge_mac_mappings\": {\"get_attr\": [\"OVNBridgeMappingsValue\", \"value\", \"ovn_static_bridge_mac_mappings\"]}}}]}], \"external_update_tasks\": [{\"name\": \"Force pull image in case image name doesn't change.\", \"when\": \"step|int == 1\", \"tags\": [\"ovn\", \"ovn_image\"], \"become\": true, \"loop\": \"{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}\", \"delegate_to\": \"{{ item }}\", \"async\": {\"get_param\": \"OVNControllerImageUpdateTimeout\"}, \"poll\": 0, \"register\": \"ovn_controller_image_update\", \"containers.podman.podman_image\": {\"name\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}, \"validate_certs\": false, \"force\": true}}, {\"name\": \"Was the ovn_controller image pull successful.\", \"when\": [\"step|int == 1\", \"'results' in ovn_controller_image_update\"], \"tags\": [\"ovn\", \"ovn_image\"], \"become\": true, \"delegate_to\": \"{{ async_result_item.item }}\", \"async_status\": {\"jid\": \"{{ async_result_item.ansible_job_id }}\"}, \"loop\": \"{{ovn_controller_image_update.results }}\", \"loop_control\": {\"loop_var\": \"async_result_item\"}, \"register\": \"async_poll_results\", \"until\": \"async_poll_results.finished\", \"retries\": {\"get_param\": \"OVNControllerImageUpdateTimeout\"}, \"delay\": 1}, {\"name\": \"OVN Container image used\", \"debug\": {\"msg\": \"ovn container will be using {{ image }}\"}, \"vars\": {\"image\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}}, \"when\": \"step|int == 1\", \"tags\": \"ovn\"}, {\"name\": \"Update OVN OVS related parameters before update.\", \"when\": [\"step|int == 1\"], \"tags\": [\"ovn\"], \"become\": true, \"vars\": {\"timeout\": {\"get_param\": \"OVNOfctrlWaitBeforeClear\"}}, \"shell\": \"set -e\\novs-vsctl set Open_vSwitch . external_ids:ovn-ofctrl-wait-before-clear={{ timeout }}\\novs-vsctl set Open_vSwitch . external_ids:ovn-monitor-all=true\\novs-vsctl set Open_vSwitch . external_ids:ovn-match-northd-version=false\\n\", \"async\": {\"get_param\": \"OVNControllerUpdateTimeout\"}, \"poll\": 0, \"register\": \"ovs_vsctl\", \"loop\": \"{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}\", \"delegate_to\": \"{{ item }}\"}, {\"name\": \"Was the update of OVN OVS related parameter successful.\", \"when\": [\"step|int == 1\", \"'results' in ovs_vsctl\"], \"become\": true, \"tags\": [\"ovn\"], \"delegate_to\": \"{{ async_result_item.item }}\", \"async_status\": {\"jid\": \"{{ async_result_item.ansible_job_id }}\"}, \"loop\": \"{{ovs_vsctl.results }}\", \"loop_control\": {\"loop_var\": \"async_result_item\"}, \"register\": \"async_poll_results\", \"until\": \"async_poll_results.finished\", \"retries\": {\"get_param\": \"OVNControllerUpdateTimeout\"}, \"delay\": 1}, {\"set_fact\": {\"any_ovn_host\": \"{{groups['ovn_controller'] | difference(groups['excluded_overcloud']) | first }}\"}, \"tags\": \"ovn\", \"when\": \"step|int == 1\"}, {\"name\": \"Find ovn_controller configs in container-startup-configs\", \"find\": {\"paths\": \"/var/lib/tripleo-config/container-startup-config/\", \"patterns\": \"*ovn_controller.json\", \"recurse\": true}, \"register\": \"ovn_cont_17_0\", \"delegate_to\": \"{{ any_ovn_host }}\", \"when\": \"(step|int == 1) and (any_ovn_host is defined) and (any_ovn_host|length > 0)\", \"tags\": [\"ovn\"], \"become\": true}, {\"name\": \"get directory path from the ovn_cont_17_0\", \"set_fact\": {\"ovn_config_path\": \"{{ ovn_cont_17_0.files.0.path | dirname }}\"}, \"when\": \"step|int == 1\", \"tags\": \"ovn\"}, {\"name\": \"Get PIDfile used by systemd on each ovn node\", \"when\": [\"step|int == 1\"], \"tags\": [\"ovn\"], \"become\": true, \"shell\": \"set -e\\ngrep PID /etc/systemd/system/tripleo_ovn_controller.service | cut -d= -f2\\n\", \"register\": \"pidfile\", \"loop\": \"{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}\", \"delegate_to\": \"{{ item }}\"}, {\"name\": \"Update ovn_controller.\", \"vars\": {\"config_step\": \"{{ ('step_4' in ovn_config_path) | ternary('4', '3')}}\", \"query\": \"results[?item == '{{item}}'].stdout\"}, \"when\": \"step|int == 1\", \"tags\": \"ovn\", \"become\": true, \"loop\": \"{{ groups['ovn_controller'] | difference(groups['excluded_overcloud']) }}\", \"delegate_to\": \"{{ item }}\", \"async\": {\"get_param\": \"OVNControllerUpdateTimeout\"}, \"poll\": 0, \"register\": \"ovn_controller_update\", \"tripleo_container_manage\": {\"config_dir\": \"{{ ovn_config_path }}\", \"config_patterns\": \"*ovn_controller.json\", \"config_id\": [\"tripleo_step{{config_step}}\"], \"log_base_path\": \"{{ container_log_stdout_path }}\", \"debug\": \"{{ enable_debug | bool }}\", \"config_overrides\": {\".*ovn_controller\": {\"image\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}, \"conmon_pidfile\": \"{{ pidfile | json_query(query) | first }}\", \"name\": \"ovn_controller\"}}}}, {\"name\": \"Was the ovn_controller successful.\", \"when\": [\"step|int == 1\", \"'results' in ovn_controller_update\"], \"tags\": \"ovn\", \"become\": true, \"delegate_to\": \"{{ async_result_item.item }}\", \"async_status\": {\"jid\": \"{{ async_result_item.ansible_job_id }}\"}, \"loop\": \"{{ovn_controller_update.results }}\", \"loop_control\": {\"loop_var\": \"async_result_item\"}, \"register\": \"async_poll_results\", \"until\": \"async_poll_results.finished\", \"retries\": {\"get_param\": \"OVNControllerUpdateTimeout\"}, \"delay\": 1}, {\"name\": \"Pause for 30s to give ovn_controllers time to reconnect to dbs\", \"when\": [\"step|int == 1\"], \"tags\": \"ovn\", \"wait_for\": {\"timeout\": 30}}], \"upgrade_tasks\": [{\"name\": \"Fetch running ovn_controller image\", \"shell\": \"set -e\\npodman inspect --format \\\"{{'{{'}}.ImageName{{'}}'}}\\\" ovn_controller\\n\", \"register\": \"running_ovn_image\", \"when\": [\"step|int == 4\"], \"tags\": [\"ovn\", \"ovn_image\"]}, {\"name\": \"Run ovn_controller upgrade\", \"tags\": [\"ovn\", \"ovn_image\"], \"vars\": {\"ovn_controller_image\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}}, \"when\": [\"step|int == 4\", \"running_ovn_image.stdout != ovn_controller_image\"], \"block\": [{\"name\": \"Force pull image in case image name doesn't change.\", \"when\": \"step|int == 4\", \"tags\": [\"ovn\", \"ovn_image\"], \"containers.podman.podman_image\": {\"name\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}, \"validate_certs\": false, \"force\": true}}, {\"name\": \"Update OVN OVS related parameters before update.\", \"when\": [\"step|int == 4\"], \"tags\": [\"ovn\"], \"vars\": {\"timeout\": {\"get_param\": \"OVNOfctrlWaitBeforeClear\"}}, \"shell\": \"set -e\\novs-vsctl set Open_vSwitch . external_ids:ovn-ofctrl-wait-before-clear={{ timeout }}\\novs-vsctl set Open_vSwitch . external_ids:ovn-monitor-all=true\\novs-vsctl set Open_vSwitch . external_ids:ovn-match-northd-version=false\\n\"}, {\"name\": \"Find ovn_controller configs in container-startup-configs\", \"find\": {\"paths\": \"/var/lib/tripleo-config/container-startup-config/\", \"patterns\": \"*ovn_controller.json\", \"recurse\": true}, \"register\": \"ovn_cont_17_0\", \"when\": [\"step|int == 4\"], \"tags\": [\"ovn\"]}, {\"name\": \"get directory path from the ovn_cont_17_0\", \"set_fact\": {\"ovn_config_path\": \"{{ ovn_cont_17_0.files.0.path | dirname }}\"}, \"when\": \"step|int == 4\", \"tags\": \"ovn\"}, {\"name\": \"Get PIDfile used by systemd on each ovn node\", \"when\": [\"step|int == 4\"], \"tags\": [\"ovn\"], \"shell\": \"set -e\\ngrep PID /etc/systemd/system/tripleo_ovn_controller.service | cut -d= -f2\\n\", \"register\": \"pidfile\"}, {\"name\": \"Update ovn_controller.\", \"vars\": {\"config_step\": \"{{ ('step_4' in ovn_config_path) | ternary('4', '3')}}\"}, \"when\": \"step|int == 4\", \"tags\": \"ovn\", \"tripleo_container_manage\": {\"config_dir\": \"{{ ovn_config_path }}\", \"config_patterns\": \"*ovn_controller.json\", \"config_id\": [\"tripleo_step{{config_step}}\"], \"log_base_path\": \"{{ container_log_stdout_path }}\", \"debug\": \"{{ enable_debug | bool }}\", \"config_overrides\": {\".*ovn_controller\": {\"image\": {\"get_param\": \"ContainerOvnControllerConfigImage\"}, \"conmon_pidfile\": \"{{ pidfile.stdout }}\", \"name\": \"ovn_controller\"}}}}, {\"name\": \"Pause for 30s to give ovn_controllers time to reconnect to dbs\", \"when\": [\"step|int == 4\"], \"tags\": \"ovn\", \"wait_for\": {\"timeout\": 30}}]}], \"scale_tasks\": [{\"when\": [\"step|int == 1\", \"container_cli == 'podman'\"], \"tags\": \"down\", \"become\": true, \"environment\": {\"OS_CLOUD\": {\"if\": [\"auth_cloud_name_set\", {\"get_param\": \"AuthCloudName\"}, {\"get_param\": \"RootStackName\"}]}}, \"block\": [{\"name\": \"Get neutron agents ID\", \"command\": \"openstack network agent list --column ID --column Host --column Binary --format yaml\", \"register\": \"neutron_agents_result\", \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false, \"changed_when\": false}, {\"name\": \"Filter only current host\", \"set_fact\": {\"neutron_agents\": \"{{ neutron_agents_result.stdout | from_yaml | selectattr('Host', 'match', ansible_facts['fqdn'] ~ '.*') | list }}\"}, \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false}, {\"name\": \"Deleting OVN agents\", \"block\": [{\"name\": \"Stop OVN containers\", \"loop\": [\"tripleo_ovn_controller\", \"tripleo_ovn_metadata_agent\"], \"service\": {\"name\": \"{{ item }}\", \"state\": \"stopped\", \"enabled\": false}, \"become\": true, \"register\": \"stop_containers\", \"failed_when\": \"('msg' in stop_containers and 'Could not find the requested service' not in stop_containers.msg) or ('rc' in stop_containers and stop_containers.rc != 0)\"}, {\"name\": \"Delete neutron agents\", \"loop\": \"{{ neutron_agents }}\", \"loop_control\": {\"loop_var\": \"agent\", \"label\": \"{{ agent.Host }}/{{ agent.Binary }}\"}, \"command\": \"openstack network agent delete {{ agent.ID }}\", \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false}]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2-mlnx-sdn-assist-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"MLNX SDN configuration assist for Neutron ML2 Plugin.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\\n\", \"type\": \"json\"}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"MlnxSDNUsername\": {\"description\": \"The username for the SDN server.\", \"type\": \"string\"}, \"MlnxSDNPassword\": {\"type\": \"string\", \"description\": \"The password for the SDN server.\", \"hidden\": true}, \"MlnxSDNToken\": {\"description\": \"The token for the SDN server.\", \"type\": \"string\", \"hidden\": true}, \"MlnxSDNUrl\": {\"description\": \"SDN server URL\", \"type\": \"string\"}, \"MlnxSDNDomain\": {\"description\": \"SDN server domain\", \"type\": \"string\", \"default\": \"cloudx\"}, \"MlnxSDNSyncEnabled\": {\"type\": \"boolean\", \"default\": true}, \"MultiInterfaceEnabled\": {\"type\": \"boolean\", \"default\": false}, \"BindNormalPortsPhysnet\": {\"type\": \"string\", \"default\": \"datacentre\"}}, \"conditions\": {\"multi_interface_enabled\": {\"equals\": [{\"get_param\": \"MultiInterfaceEnabled\"}, true]}}, \"resources\": {\"NeutronMl2Base\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the MLNX SDN ML2 Plugin.\", \"value\": {\"service_name\": \"neutron_plugin_ml2_mlnx_sdn_assist\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"config_settings\"]}, {\"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::sdn_username\": {\"get_param\": \"MlnxSDNUsername\"}, \"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::sdn_password\": {\"get_param\": \"MlnxSDNPassword\"}, \"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::sdn_token\": {\"get_param\": \"MlnxSDNToken\"}, \"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::sdn_url\": {\"get_param\": \"MlnxSDNUrl\"}, \"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::sdn_domain\": {\"get_param\": \"MlnxSDNDomain\"}, \"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::sync_enabled\": {\"get_param\": \"MlnxSDNSyncEnabled\"}}, {\"if\": [\"multi_interface_enabled\", {\"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::bind_normal_ports\": {\"get_param\": \"MultiInterfaceEnabled\"}, \"neutron::plugins::ml2::mellanox::mlnx_sdn_assist::bind_normal_ports_physnets\": {\"get_param\": \"BindNormalPortsPhysnet\"}}, {}]}]}, \"service_config_settings\": {}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": \"neutron_plugin_ml2\", \"step_config\": \"include tripleo::profile::base::neutron::plugins::ml2\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {}, \"docker_config\": {}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2-cisco-vts-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"VTS Controller Settings for Neutron ML2 Plugin (Docker)\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"VTSUsername\": {\"description\": \"The username for the VTS server.\", \"type\": \"string\"}, \"VTSPassword\": {\"type\": \"string\", \"description\": \"The password for the VTS server.\", \"hidden\": true}, \"VTSServer\": {\"description\": \"VTS Server IP address\", \"type\": \"string\"}, \"VTSVMMID\": {\"description\": \"VMM ID used on VTS\", \"type\": \"string\", \"default\": \"\"}, \"VTSSiteId\": {\"description\": \"VTS Site Id of the controller\", \"type\": \"string\", \"default\": \"\"}, \"VTSPort\": {\"description\": \"Port of the VTS Server\", \"type\": \"number\", \"default\": 8888}, \"VTSTimeout\": {\"description\": \"Timeout for VTS server\", \"type\": \"number\", \"default\": 120}}, \"resources\": {\"NeutronMl2Base\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron ML2 Cisco VTS Plugin role.\", \"value\": {\"service_name\": \"neutron_plugin_ml2_cisco_vts\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"config_settings\"]}, {\"vts::vts_ip\": {\"get_param\": \"VTSServer\"}, \"vts::vts_port\": {\"get_param\": \"VTSPort\"}, \"vts::vts_siteid\": {\"get_param\": \"VTSSiteId\"}, \"neutron::plugins::ml2::cisco::vts::vts_username\": {\"get_param\": \"VTSUsername\"}, \"neutron::plugins::ml2::cisco::vts::vts_password\": {\"get_param\": \"VTSPassword\"}, \"neutron::plugins::ml2::cisco::vts::vts_vmmid\": {\"get_param\": \"VTSVMMID\"}, \"neutron::plugins::ml2::cisco::vts::vts_timeout\": {\"get_param\": \"VTSTimeout\"}}]}, \"service_config_settings\": {}, \"metadata_settings\": {\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"metadata_settings\"]}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": \"neutron_plugin_ml2\", \"step_config\": \"include tripleo::profile::base::neutron::plugins::ml2\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {}, \"docker_config\": {}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-plugin-ml2-ansible-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Neutron ML2 networking-ansible Plugin (Docker)\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ML2HostConfigs\": {\"description\": \"ML2 config for switches\", \"default\": {}, \"type\": \"json\"}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}}, \"resources\": {\"NeutronMl2Base\": {\"type\": \"OS::TripleO::Services::NeutronMl2PluginBase\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron ML2 ansible Plugin role.\", \"value\": {\"service_name\": \"neutron_plugin_ml2_ansible\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"config_settings\"]}, {\"neutron::plugins::ml2::networking_ansible::host_configs\": {\"get_param\": \"ML2HostConfigs\"}}, {\"neutron_redis_password\": {\"get_param\": \"RedisPassword\"}}]}, \"service_config_settings\": {}, \"metadata_settings\": {\"get_attr\": [\"NeutronMl2Base\", \"role_data\", \"metadata_settings\"]}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": \"neutron_plugin_ml2\", \"step_config\": \"include tripleo::profile::base::neutron::plugins::ml2\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {}, \"docker_config\": {}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-controller-plugin-nuage.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron Nuage VRS\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NuageActiveController\": {\"description\": \"IP address of the Active Virtualized Services Controller (VSC)\", \"type\": \"string\"}, \"NuageStandbyController\": {\"description\": \"IP address of the Standby Virtualized Services Controller (VSC)\", \"type\": \"string\"}, \"NuageBridgeMTU\": {\"description\": \"Support for non-default MTU configured on each VRS node\", \"type\": \"string\", \"default\": \"\"}, \"NuageDisableDhcp4\": {\"description\": \"Make VRS act as Dhcp server or not\", \"type\": \"boolean\", \"default\": false}, \"NuageControllerEnableMetadataAgent\": {\"description\": \"Enbale Nuage Metadata Agent on Controller or not\", \"type\": \"boolean\", \"default\": false}, \"ControllerVxlanIPtableRule\": {\"description\": \"Open Vxlan Port on Controller node or not\", \"type\": \"boolean\", \"default\": false}}, \"conditions\": {\"apply_vxlan_iptables_rule\": {\"equals\": [{\"get_param\": \"ControllerVxlanIPtableRule\"}, true]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron Controller  Nuage plugin\", \"value\": {\"firewall_rules\": [{\"if\": [\"apply_vxlan_iptables_rule\", {\"118 neutron vxlan networks\": {\"proto\": \"udp\", \"dport\": 4789}}, {}]}], \"service_name\": \"neutron_controller_plugin_nuage\", \"config_settings\": {\"map_merge\": [{\"nuage::vrs::active_controller\": {\"get_param\": \"NuageActiveController\"}, \"nuage::vrs::standby_controller\": {\"get_param\": \"NuageStandbyController\"}, \"nuage::vrs::bridge_mtu\": {\"get_param\": \"NuageBridgeMTU\"}, \"nuage::vrs::disable_dhcp4\": {\"get_param\": \"NuageDisableDhcp4\"}, \"tripleo::profile::base::neutron::agents::nuage::enable_metadata_agent\": {\"get_param\": \"NuageControllerEnableMetadataAgent\"}}]}, \"step_config\": \"include tripleo::profile::base::neutron::agents::nuage\"}}}}", "file:///root/tripleo-heat-installer-templates/deployment/pacemaker/pacemaker-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Pacemaker service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"MonitoringSubscriptionPacemaker\": {\"default\": \"overcloud-pacemaker\", \"type\": \"string\"}, \"CorosyncIPv6\": {\"default\": false, \"description\": \"Enable IPv6 in Corosync\", \"type\": \"boolean\"}, \"EnableFencing\": {\"default\": false, \"description\": \"Whether to enable fencing in Pacemaker or not.\", \"type\": \"boolean\"}, \"PacemakerTLSPriorities\": {\"type\": \"string\", \"description\": \"Pacemaker TLS Priorities\", \"default\": \"\"}, \"PacemakerRemoteAuthkey\": {\"type\": \"string\", \"description\": \"The authkey for the pacemaker remote service.\", \"hidden\": true}, \"PcsdPassword\": {\"type\": \"string\", \"description\": \"The password for the 'pcsd' user for pacemaker.\", \"hidden\": true}, \"CorosyncTokenTimeout\": {\"type\": \"number\", \"description\": \"Time in milliseconds until a token loss is declared after not receiving a token.\", \"default\": 10000}, \"CorosyncSettleTries\": {\"type\": \"number\", \"description\": \"Number of tries for cluster settling. This has the same default as the pacemaker puppet module. Override to a smaller value when in need to replace a controller node.\", \"default\": 360}, \"FencingConfig\": {\"default\": {}, \"description\": \"Pacemaker fencing configuration. The JSON should have\\nthe following structure:\\n  {\\n    \\\"devices\\\": [\\n      {\\n        \\\"agent\\\": \\\"AGENT_NAME\\\",\\n        \\\"host_mac\\\": \\\"HOST_MAC_ADDRESS\\\",\\n        \\\"params\\\": {\\\"PARAM_NAME\\\": \\\"PARAM_VALUE\\\"}\\n      }\\n    ]\\n  }\\nFor instance:\\n  {\\n    \\\"devices\\\": [\\n      {\\n        \\\"agent\\\": \\\"fence_xvm\\\",\\n        \\\"host_mac\\\": \\\"52:54:00:aa:bb:cc\\\",\\n        \\\"params\\\": {\\n          \\\"multicast_address\\\": \\\"225.0.0.12\\\",\\n          \\\"port\\\": \\\"baremetal_0\\\",\\n          \\\"manage_fw\\\": true,\\n          \\\"manage_key_file\\\": true,\\n          \\\"key_file\\\": \\\"/etc/fence_xvm.key\\\",\\n          \\\"key_file_password\\\": \\\"abcdef\\\"\\n        }\\n      }\\n    ]\\n  }\\n\", \"type\": \"json\"}, \"PacemakerLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"system.pacemaker\", \"file\": \"/var/log/host/pacemaker/pacemaker.log\", \"startmsg.regex\": \"^[a-zA-Z]{3} [0-9]{2} [:0-9]{8}\"}}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"EnableInstanceHA\": {\"default\": false, \"description\": \"Whether to enable an Instance Ha configurarion or not. This setup requires the Compute role to have the PacemakerRemote service added to it.\", \"type\": \"boolean\"}, \"PacemakerBundleOperationTimeout\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The timeout for start, monitor and stop operations run by the container resource agent, in seconds. When set to default '', the timeout comes from pacemaker's default operation timeouts (20s). When set to default and podman is used, force the timeout to 120s.\", \"constraints\": [{\"allowed_pattern\": \"([1-9][0-9]*s)?\"}]}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"CorosyncIPv6\"]}], \"conditions\": {\"pcmk_tls_priorities_empty\": {\"equals\": [{\"get_param\": \"PacemakerTLSPriorities\"}, \"\"]}, \"pcmk_bundle_op_timeout_empty\": {\"equals\": [{\"get_param\": \"PacemakerBundleOperationTimeout\"}, \"\"]}, \"podman_enabled\": {\"equals\": [{\"get_param\": \"ContainerCli\"}, \"podman\"]}, \"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"PacemakerNetwork\"]}]}, 6]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Pacemaker role.\", \"value\": {\"service_name\": \"pacemaker\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionPacemaker\"}, \"firewall_rules\": {\"130 pacemaker tcp\": {\"proto\": \"tcp\", \"dport\": [2224, 3121, 21064]}, \"131 pacemaker udp\": {\"proto\": \"udp\", \"dport\": 5405}}, \"config_settings\": {\"map_merge\": [{\"pacemaker::corosync::cluster_name\": \"tripleo_cluster\", \"pacemaker::corosync::manage_fw\": false, \"pacemaker::resource_defaults::defaults\": {\"resource-stickiness\": {\"value\": \"INFINITY\"}}, \"corosync_token_timeout\": {\"get_param\": \"CorosyncTokenTimeout\"}, \"pacemaker::corosync::settle_tries\": {\"get_param\": \"CorosyncSettleTries\"}, \"pacemaker::resource::bundle::deep_compare\": true, \"pacemaker::resource::ip::deep_compare\": true, \"pacemaker::resource::ocf::deep_compare\": true, \"corosync_ipv6\": {\"if\": [\"is_ipv6\", true, false]}, \"tripleo::fencing::config\": {\"get_param\": \"FencingConfig\"}, \"tripleo::fencing::deep_compare\": true, \"enable_fencing\": {\"get_param\": \"EnableFencing\"}, \"hacluster_pwd\": {\"get_param\": \"PcsdPassword\"}, \"tripleo::profile::base::pacemaker::remote_authkey\": {\"get_param\": \"PacemakerRemoteAuthkey\"}, \"tripleo::profile::base::pacemaker::pcsd_bind_addr\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PacemakerNetwork\"]}}}}}, {\"if\": [\"pcmk_tls_priorities_empty\", {}, {\"tripleo::pacemaker::tls_priorities\": {\"get_param\": \"PacemakerTLSPriorities\"}}]}, {\"if\": [{\"and\": [\"pcmk_bundle_op_timeout_empty\", {\"not\": \"podman_enabled\"}]}, {}, {\"tripleo::profile::base::pacemaker::resource_op_defaults\": {\"bundle\": {\"name\": \"timeout\", \"value\": {\"if\": [\"pcmk_bundle_op_timeout_empty\", \"120s\", {\"get_param\": \"PacemakerBundleOperationTimeout\"}]}}}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_pacemaker\": [{\"get_param\": \"PacemakerLoggingSource\"}]}}, \"step_config\": \"include tripleo::profile::base::pacemaker\\n\", \"host_prep_tasks\": [{\"name\": \"Make sure python3-novaclient is installed when IHA is enabled\", \"package\": {\"name\": \"python3-novaclient\", \"state\": \"present\"}, \"when\": {\"get_param\": \"EnableInstanceHA\"}}, {\"name\": \"Remove existing entries from logind conf\", \"ansible.builtin.lineinfile\": {\"path\": \"/etc/systemd/logind.conf\", \"regexp\": \"^\\\\s*#?\\\\s*HandlePowerKey\\\\s*=.*\", \"state\": \"absent\"}}, {\"name\": \"Make sure systemd-logind ignores power off\", \"ansible.builtin.lineinfile\": {\"path\": \"/etc/systemd/logind.conf\", \"regexp\": \"^#?HandlePowerKey\", \"line\": \"HandlePowerKey=ignore\"}}, {\"name\": \"Restart systemd-logind\", \"ansible.builtin.service\": {\"name\": \"systemd-logind\", \"state\": \"restarted\"}}, {\"name\": \"Gather service_facts on pacemaker_bootstrap_node\", \"ansible.builtin.service_facts\": null, \"when\": [\"{{(pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}\", {\"get_param\": \"EnableInstanceHA\"}]}, {\"name\": \"Check and eventually delete duplicate constraints (bootstrap node)\", \"become\": true, \"shell\": \"COUNT=$(cibadmin --query | xmllint --xpath '//rsc_location[@rsc=\\\"stonith-fence_compute-fence-nova\\\"]/@id' - |grep -oP '(?<=[\\\"])[^\\\"]*' -c)\\nif [[ $COUNT > 1 ]]; then\\n    echo \\\"Detected $COUNT duplicate constraints, deleting them\\\"\\n    # assemble string with current list of computes\\n    GOOD=$(echo location-stonith-fence_compute-fence-nova-$(hiera pacemaker_remote_short_node_names |grep -oP '\\\".*?\\\"' |tr -d '\\\"'|tr -d '\\\\n' )--10000)\\n    # delete old constraints\\n    for i in $(cibadmin --query | xmllint --xpath '//rsc_location[@rsc=\\\"stonith-fence_compute-fence-nova\\\"]/@id' - |grep -oP '(?<=[\\\"])[^\\\"]*' |grep -v $GOOD ); do pcs constraint delete $i ; done\\nelse\\n    echo \\\"No duplicate constraint found\\\"\\nfi\\n\", \"when\": [\"{{(pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}\", {\"get_param\": \"EnableInstanceHA\"}, \"ansible_facts['services']['pacemaker.service']['state'] == 'running'\"]}], \"scale_tasks\": [{\"when\": [\"step|int == 1\", \"container_cli == 'podman'\", \"\\\"pacemaker_remote\\\" in enabled_services|list\", \"inventory_hostname_short in compute_instanceha_short_node_names\"], \"tags\": \"down\", \"become\": true, \"block\": [{\"name\": \"Getting Nova compute hostname\", \"command\": \"crm_node -n\", \"register\": \"nova_compute_hostname\"}, {\"name\": \"Check if pacemaker_short_bootstrap_node_name is a defined variable\", \"when\": \"pacemaker_short_bootstrap_node_name is not defined\", \"fail\": {\"msg\": \"Cannot delegate pacemaker cleanup to the bootstrap node. Please delete the resources manually.\"}, \"ignore_errors\": true}, {\"name\": \"Clean up Pacemaker remote and STONITH resources for Compute node\", \"when\": [\"nova_compute_hostname.stdout in compute_instanceha_short_node_names\", \"pacemaker_short_bootstrap_node_name is defined\"], \"block\": [{\"name\": \"List STONITH resource for the Compute node\", \"command\": \"stonith_admin -l {{ nova_compute_hostname.stdout }}\", \"register\": \"stonith_service_results\", \"delegate_to\": \"{{ pacemaker_short_bootstrap_node_name }}\"}, {\"name\": \"Disable the STONITH resources for the Compute node\", \"command\": \"pcs stonith disable \\\"{{ item }}\\\"\", \"loop\": \"{{ stonith_service_results.stdout | regex_findall('^(stonith-fence(?!_compute-fence-nova).*)', multiline=True)}}\", \"delegate_to\": \"{{ pacemaker_short_bootstrap_node_name }}\", \"register\": \"disable_output\", \"failed_when\": \"disable_output.rc != 0\", \"retries\": 3, \"delay\": 5, \"until\": \"disable_output.rc == 0\"}, {\"name\": \"Delete the STONITH resources for the Compute node\", \"command\": \"pcs stonith delete \\\"{{ item }}\\\"\", \"loop\": \"{{ stonith_service_results.stdout | regex_findall('^(stonith-fence(?!_compute-fence-nova).*)', multiline=True)}}\", \"delegate_to\": \"{{ pacemaker_short_bootstrap_node_name }}\", \"register\": \"delete_output\", \"failed_when\": \"delete_output.rc != 0\", \"retries\": 3, \"delay\": 5, \"until\": \"delete_output.rc == 0\"}, {\"name\": \"Clear the stonith level hierarchy for the Compute node target\", \"command\": \"pcs stonith level clear target {{ nova_compute_hostname.stdout }}\", \"delegate_to\": \"{{ pacemaker_short_bootstrap_node_name }}\"}, {\"name\": \"Delete Compute node from cluster\", \"command\": \"pcs cluster node remove-remote {{ nova_compute_hostname.stdout }}\", \"delegate_to\": \"{{ pacemaker_short_bootstrap_node_name }}\"}, {\"name\": \"Remove compute node in pcmk_host_list parameter from stonith-fence_compute-fence-nova\", \"command\": \"crm_resource --set-parameter=pcmk_host_list -r stonith-fence_compute-fence-nova -v \\\"{{ pacemaker_remote_short_node_names | reject('search', nova_compute_hostname.stdout) | join(',') }}\\\"\", \"delegate_to\": \"{{ pacemaker_short_bootstrap_node_name }}\"}]}]}], \"upgrade_tasks\": [{\"name\": \"Ensure redis is removed\", \"when\": [\"step|int == 5\", \"\\\"redis\\\" not in enabled_services|list\", \"{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}\"], \"become\": true, \"shell\": \"if crm_resource -r redis-bundle -q &>/dev/null; then\\n   pcs resource delete redis-bundle || true\\n   pcs resource delete ip-$(hiera redis_vip) || true\\nfi\\n\"}, {\"name\": \"Clean up cluster node cache\", \"when\": [\"step|int == 5\", \"\\\"redis\\\" not in enabled_services|list\", \"{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}\"], \"become\": true, \"shell\": \"pcs cluster node clear redis-bundle-0\\npcs cluster node clear redis-bundle-1\\npcs cluster node clear redis-bundle-2\\ncrm_attribute --name redis_REPL_INFO --delete\\n\"}, {\"name\": \"Clean up redis attribute\", \"when\": [\"step|int == 5\", \"\\\"redis\\\" not in enabled_services|list\", \"{{ (pacemaker_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower)|bool}}\"], \"become\": true, \"shell\": \"pcs node attribute \\\"{{ item }}\\\" redis-role= || true\\n\", \"loop\": \"{{ pacemaker_short_node_names }}\"}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_stop_services\", \"system_upgrade_transfer_data\"], \"block\": [{\"name\": \"Stop cluster\", \"become\": true, \"shell\": \"set -eu\\nFILE=/usr/sbin/pcs\\nif test -f \\\"$FILE\\\"; then\\n  /usr/sbin/pcs cluster stop --force\\nfi\\n\", \"delegate_to\": \"{{ item }}\", \"with_items\": \"{{ groups['pacemaker'] | difference(groups['excluded_overcloud']) }}\"}]}], \"update_tasks\": [{\"name\": \"Check pacemaker cluster running before the minor update\", \"when\": \"step|int == 0\", \"pacemaker_cluster\": \"state=online check_and_fail=true\", \"async\": 30, \"poll\": 4}, {\"name\": \"Acquire the cluster shutdown lock to stop pacemaker cluster\", \"when\": \"step|int == 1\", \"command\": \"systemd-cat -t ha-shutdown /var/lib/container-config-scripts/pacemaker_mutex_shutdown.sh --acquire\"}, {\"name\": \"Stop pacemaker cluster\", \"when\": \"step|int == 1\", \"pacemaker_cluster\": \"state=offline\"}, {\"name\": \"Start pacemaker cluster\", \"when\": \"step|int == 4\", \"pacemaker_cluster\": \"state=online\"}, {\"name\": \"Release the cluster shutdown lock\", \"when\": \"step|int == 4\", \"command\": \"systemd-cat -t ha-shutdown /var/lib/container-config-scripts/pacemaker_mutex_shutdown.sh --release\"}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/pacemaker/pacemaker-remote-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Pacemaker remote service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"PacemakerRemoteAuthkey\": {\"type\": \"string\", \"description\": \"The authkey for the pacemaker remote service.\", \"hidden\": true}, \"PcsdPassword\": {\"type\": \"string\", \"description\": \"The password for the 'pcsd' user for pacemaker.\", \"hidden\": true}, \"MonitoringSubscriptionPacemakerRemote\": {\"default\": \"overcloud-pacemaker_remote\", \"type\": \"string\"}, \"EnableFencing\": {\"default\": false, \"description\": \"Whether to enable fencing in Pacemaker or not.\", \"type\": \"boolean\"}, \"FencingConfig\": {\"default\": {}, \"description\": \"Pacemaker fencing configuration. The JSON should have\\nthe following structure:\\n  {\\n    \\\"devices\\\": [\\n      {\\n        \\\"agent\\\": \\\"AGENT_NAME\\\",\\n        \\\"host_mac\\\": \\\"HOST_MAC_ADDRESS\\\",\\n        \\\"params\\\": {\\\"PARAM_NAME\\\": \\\"PARAM_VALUE\\\"}\\n      }\\n    ]\\n  }\\nFor instance:\\n  {\\n    \\\"devices\\\": [\\n      {\\n        \\\"agent\\\": \\\"fence_xvm\\\",\\n        \\\"host_mac\\\": \\\"52:54:00:aa:bb:cc\\\",\\n        \\\"params\\\": {\\n          \\\"multicast_address\\\": \\\"225.0.0.12\\\",\\n          \\\"port\\\": \\\"baremetal_0\\\",\\n          \\\"manage_fw\\\": true,\\n          \\\"manage_key_file\\\": true,\\n          \\\"key_file\\\": \\\"/etc/fence_xvm.key\\\",\\n          \\\"key_file_password\\\": \\\"abcdef\\\"\\n        }\\n      }\\n    ]\\n  }\\n\", \"type\": \"json\"}, \"PacemakerRemoteLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"system.pacemaker_remote\", \"file\": \"/var/log/host/pacemaker.log\", \"startmsg.regex\": \"^[a-zA-Z]{3} [0-9]{2} [:0-9]{8}\"}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Pacemaker remote role.\", \"value\": {\"service_name\": \"pacemaker_remote\", \"firewall_rules\": {\"130 pacemaker_remote tcp\": {\"proto\": \"tcp\", \"dport\": [2224, 3121]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionPacemakerRemote\"}, \"config_settings\": {\"tripleo::fencing::config\": {\"get_param\": \"FencingConfig\"}, \"tripleo::fencing::deep_compare\": true, \"enable_fencing\": {\"get_param\": \"EnableFencing\"}, \"tripleo::profile::base::pacemaker_remote::remote_authkey\": {\"get_param\": \"PacemakerRemoteAuthkey\"}, \"tripleo::profile::base::pacemaker_remote::pcsd_bind_addr\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PacemakerRemoteNetwork\"]}}}}, \"pacemaker::corosync::manage_fw\": false, \"hacluster_pwd\": {\"get_param\": \"PcsdPassword\"}}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_pacemaker_remote\": [{\"get_param\": \"PacemakerRemoteLoggingSource\"}]}}, \"step_config\": \"include tripleo::profile::base::pacemaker_remote\\n\", \"host_prep_tasks\": [{\"name\": \"Remove existing entries from logind conf\", \"ansible.builtin.lineinfile\": {\"path\": \"/etc/systemd/logind.conf\", \"regexp\": \"^\\\\s*#?\\\\s*HandlePowerKey\\\\s*=.*\", \"state\": \"absent\"}}, {\"name\": \"Make sure systemd-logind ignores power off\", \"ansible.builtin.lineinfile\": {\"path\": \"/etc/systemd/logind.conf\", \"regexp\": \"^#?HandlePowerKey\", \"line\": \"HandlePowerKey=ignore\"}}, {\"name\": \"Restart systemd-logind\", \"ansible.builtin.service\": {\"name\": \"systemd-logind\", \"state\": \"restarted\"}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/rabbitmq/rabbitmq-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Rabbitmq service\\n\", \"parameters\": {\"ContainerRabbitmqImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerRabbitmqConfigImage\": {\"description\": \"The container image to use for the rabbitmq config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"RabbitCookie\": {\"type\": \"string\", \"default\": \"\", \"hidden\": true}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"RabbitUserName\": {\"default\": \"guest\", \"description\": \"The username for RabbitMQ\", \"type\": \"string\"}, \"RabbitPassword\": {\"description\": \"The password for RabbitMQ\", \"type\": \"string\", \"hidden\": true}, \"RabbitFDLimit\": {\"default\": 65536, \"description\": \"Configures RabbitMQ FD limit\", \"type\": \"number\"}, \"RabbitTCPBacklog\": {\"default\": 4096, \"description\": \"Configures RabbitMQ maximum TCP Backlog\", \"type\": \"number\"}, \"RabbitIPv6\": {\"default\": false, \"description\": \"Enable IPv6 in RabbitMQ\", \"type\": \"boolean\"}, \"RabbitHAQueues\": {\"description\": \"The number of HA queues to be configured in rabbit. The default is -1 which translates to \\\"ha-mode all\\\". The special value 0 will be automatically overridden to CEIL(N/2) where N is the number of nodes running rabbitmq.\", \"default\": 0, \"type\": \"number\"}, \"RabbitNetTickTime\": {\"description\": \"The number of seconds to configure the value of the erlang net_ticktime kernel variable.\", \"default\": 15, \"type\": \"number\"}, \"RabbitFIPS\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Configures RabbitMQ to run in FIPS mode\"}, \"RabbitAdditionalErlArgs\": {\"description\": \"Additional parameters passed to the Erlang subsystem. The string needs to be enclosed in quotes twice. We default to '+sbwt none +sbwtdcpu none +sbwtdio none' in order to have the erlang vm be less busy on spinlocks, but we allow a simple way of overriding it.\", \"default\": \"'+sbwt none +sbwtdcpu none +sbwtdio none'\", \"type\": \"string\"}, \"MonitoringSubscriptionRabbitmq\": {\"default\": \"overcloud-rabbitmq\", \"type\": \"string\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"RabbitmqCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"RabbitmqEnableManagementAccess\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Allow access to RabbitMQ management plugin over network\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"RabbitIPv6\"]}], \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}]}, 6]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"RabbitmqCertificateKeySize\"}, \"\"]}, \"rabbitmq_cacert_set\": {\"not\": {\"equals\": [{\"get_param\": \"InternalTLSCAFile\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerRabbitmqImage\": \"ContainerRabbitmqImage\", \"ContainerRabbitmqConfigImage\": \"ContainerRabbitmqConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerRabbitmqImage\": {\"get_param\": \"ContainerRabbitmqImage\"}, \"ContainerRabbitmqConfigImage\": {\"get_param\": \"ContainerRabbitmqConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Rabbitmq API role.\", \"value\": {\"service_name\": \"rabbitmq\", \"firewall_rules\": {\"109 rabbitmq\": {\"dport\": {\"list_concat\": [[4369, 5672, 25672, \"25673-25683\"], {\"if\": [{\"get_param\": \"RabbitmqEnableManagementAccess\"}, [15672]]}]}}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionRabbitmq\"}, \"config_settings\": {\"map_merge\": [{\"rabbitmq::file_limit\": {\"get_param\": \"RabbitFDLimit\"}, \"rabbitmq::default_user\": {\"get_param\": \"RabbitUserName\"}, \"rabbitmq::default_pass\": {\"get_param\": \"RabbitPassword\"}, \"rabbit_ipv6\": {\"if\": [\"is_ipv6\", true, false]}, \"rabbitmq::delete_guest_user\": false, \"rabbitmq::wipe_db_on_cookie_change\": true, \"rabbitmq::port\": 5672, \"rabbitmq::loopback_users\": [], \"rabbitmq::tcp_backlog\": {\"get_param\": \"RabbitTCPBacklog\"}, \"rabbitmq::repos_ensure\": false, \"rabbitmq::tcp_keepalive\": true, \"rabbitmq_environment\": {\"LANG\": \"en_US.UTF-8\", \"LC_ALL\": \"en_US.UTF-8\", \"NODE_PORT\": \"\", \"NODE_IP_ADDRESS\": \"\", \"RABBITMQ_NODENAME\": {\"str_replace\": {\"template\": \"rabbit@%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}}}}, \"RABBITMQ_USE_LONGNAME\": \"true\", \"RABBITMQ_CTL_DIST_PORT_MIN\": \"25673\", \"RABBITMQ_CTL_DIST_PORT_MAX\": \"25683\", \"export ERL_EPMD_ADDRESS\": \"%{hiera('rabbitmq::interface')}\"}, \"tripleo::profile::base::rabbitmq::additional_erl_args\": {\"get_param\": \"RabbitAdditionalErlArgs\"}, \"rabbitmq_kernel_variables\": {\"inet_dist_listen_min\": \"25672\", \"inet_dist_listen_max\": \"25672\", \"net_ticktime\": {\"get_param\": \"RabbitNetTickTime\"}}, \"rabbitmq_config_variables\": {\"cluster_partition_handling\": \"ignore\", \"queue_master_locator\": \"<<\\\"min-masters\\\">>\"}, \"rabbitmq::config_additional_variables\": {\"lager\": \"[{crash_log_count, 0}, { crash_log_date, \\\"\\\"}, { crash_log_size, 0 }]\"}, \"rabbitmq::erlang_cookie\": {\"get_param\": \"RabbitCookie\"}, \"rabbitmq::interface\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}}}}, \"rabbitmq::nr_ha_queues\": {\"get_param\": \"RabbitHAQueues\"}, \"rabbitmq::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::ssl_erl_dist\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::ssl_port\": 5672, \"rabbitmq::ssl_depth\": 1, \"rabbitmq::ssl_only\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::ssl_interface\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}}}}, \"tripleo::profile::base::rabbitmq::enable_internal_tls\": {\"get_param\": \"EnableInternalTLS\"}, \"tripleo::profile::base::rabbitmq::fips_mode\": {\"get_param\": \"RabbitFIPS\"}, \"rabbitmq::collect_statistics_interval\": 30000}, {\"if\": [\"internal_tls_enabled\", {\"tripleo::rabbitmq::service_certificate\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"tripleo::profile::base::rabbitmq::certificate_specs\": {\"service_certificate\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"service_key\": \"/etc/pki/tls/private/rabbitmq.key\"}, \"rabbitmq::ssl_versions\": {\"if\": [{\"get_param\": \"RabbitFIPS\"}, [\"tlsv1.2\", \"tlsv1.3\"], [\"tlsv1.2\"]]}}, {}]}, {\"rabbitmq::admin_enable\": false, \"rabbitmq::management_enable\": true, \"rabbitmq::use_config_file_for_plugins\": true, \"rabbitmq::management_ip_address\": {\"if\": [{\"get_param\": \"RabbitmqEnableManagementAccess\"}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqManagementNetwork\"]}}}}, \"127.0.0.1\"]}, \"rabbitmq::management_port\": 15672, \"rabbitmq::config_management_variables\": {\"rates_mode\": \"none\"}}, {\"if\": [\"rabbitmq_cacert_set\", {\"rabbitmq::ssl_cacert\": {\"get_param\": \"InternalTLSCAFile\"}, \"rabbitmq::ssl_management_cacert\": {\"get_param\": \"InternalTLSCAFile\"}}]}, {\"if\": [\"internal_tls_enabled\", {\"tripleo::certmonger::rabbitmq::postsave_cmd\": \"true\"}, {}]}]}, \"puppet_config\": {\"config_volume\": \"rabbitmq\", \"step_config\": {\"list_join\": [\"\\n\", [\"['Rabbitmq_policy', 'Rabbitmq_user'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::base::rabbitmq\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/rabbitmq.json\": {\"command\": \"/usr/lib/rabbitmq/bin/rabbitmq-server\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/lib/rabbitmq\", \"owner\": \"rabbitmq:rabbitmq\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"owner\": \"rabbitmq:rabbitmq\", \"optional\": true}, {\"path\": \"/etc/pki/tls/private/rabbitmq.key\", \"owner\": \"rabbitmq:rabbitmq\", \"optional\": true}]}}, \"docker_config\": {\"step_1\": {\"rabbitmq_init_logs\": {\"start_order\": 0, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/rabbitmq:/var/log/rabbitmq\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R rabbitmq:rabbitmq /var/log/rabbitmq\"]}, \"rabbitmq_bootstrap\": {\"start_order\": 1, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"host\", \"privileged\": false, \"user\": \"root\", \"command\": [\"bash\", \"-ec\", {\"list_join\": [\"\\n\", [\"kolla_set_configs\", \"if [[ -e \\\"/var/lib/rabbitmq/.erlang.cookie\\\" ]]; then rm -f /var/lib/rabbitmq/.erlang.cookie; fi\", \"hiera 'rabbitmq::erlang_cookie' > /var/lib/rabbitmq/.erlang.cookie\", \"chown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\", \"chmod 400 /var/lib/rabbitmq/.erlang.cookie\"]]}], \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro\", \"/etc/puppet:/etc/puppet:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq\", \"/var/log/containers/rabbitmq:/var/log/rabbitmq\"], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro\", \"/etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"rabbitmq\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq:z\", \"/var/log/containers/rabbitmq:/var/log/rabbitmq:z\"], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro\", \"/etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"container_puppet_tasks\": {\"step_2\": {\"config_volume\": \"rabbit_init_tasks\", \"puppet_tags\": \"rabbitmq_policy,rabbitmq_user\", \"step_config\": \"include tripleo::profile::base::rabbitmq\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqConfigImage\"]}, \"volumes\": [\"/var/lib/config-data/puppet-generated/rabbitmq/etc/rabbitmq:/etc/rabbitmq:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq\"]}}, \"metadata_settings\": {\"if\": [\"internal_tls_enabled\", [{\"service\": \"rabbitmq\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}, \"type\": \"node\"}], null]}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"rabbitmq\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"rabbitmq/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RabbitmqNetwork\"]}}}}, \"run_after\": \"container_name=$({{container_cli}} ps --format=\\\\{\\\\{.Names\\\\}\\\\} | grep -w -E 'rabbitmq(-bundle-.*-[0-9]+)?')\\nservice_crt=\\\"/etc/pki/tls/certs/rabbitmq.crt\\\"\\nservice_key=\\\"/etc/pki/tls/private/rabbitmq.key\\\"\\nif echo \\\"$container_name\\\" | grep -q \\\"^rabbitmq-bundle\\\"; then\\n  # lp#1917868: Do not use podman cp with HA containers as they get\\n  # frozen temporarily and that can make pacemaker operation fail.\\n  tar -c \\\"$service_crt\\\" \\\"$service_key\\\" | {{container_cli}} exec -i \\\"$container_name\\\" tar -C / -xv\\n  # no need to update the mount point, because pacemaker\\n  # recreates the container when it's restarted\\nelse\\n  # Refresh the cert at the mount-point\\n  {{container_cli}} cp $service_crt \\\"$container_name:/var/lib/kolla/config_files/src-tls/$service_crt\\\"\\n  # Refresh the key at the mount-point\\n  {{container_cli}} cp $service_key \\\"$container_name:/var/lib/kolla/config_files/src-tls/$service_key\\\"\\n  # Copy the new cert from the mount-point to the real path\\n  {{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_crt\\\" \\\"$service_crt\\\"\\n  # Copy the new key from the mount-point to the real path\\n  {{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_key\\\" \\\"$service_key\\\"\\nfi\\n# Set appropriate permissions\\n{{container_cli}} exec -u root \\\"$container_name\\\" chown rabbitmq:rabbitmq \\\"$service_crt\\\"\\n{{container_cli}} exec -u root \\\"$container_name\\\" chown rabbitmq:rabbitmq \\\"$service_key\\\"\\n# Trigger a pem cache clear in RabbitMQ to read the new certificates\\n{{container_cli}} exec \\\"$container_name\\\" rabbitmqctl eval \\\"ssl:clear_pem_cache().\\\"\\n\", \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"RabbitmqCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], \"host_prep_tasks\": [{\"name\": \"creat fcontext entry for rabbitmq data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/rabbitmq(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/rabbitmq\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/rabbitmq\", \"setype\": \"container_file_t\"}]}], \"upgrade_tasks\": [], \"update_tasks\": null}}}}", "file:///root/tripleo-heat-installer-templates/deployment/rabbitmq/rabbitmq-messaging-rpc-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Rabbitmq service\\n\", \"parameters\": {\"ContainerRabbitmqImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerRabbitmqConfigImage\": {\"description\": \"The container image to use for the rabbitmq config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"RabbitCookie\": {\"type\": \"string\", \"default\": \"\", \"hidden\": true}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"RpcPort\": {\"default\": 5672, \"description\": \"The network port for messaging backend\", \"type\": \"number\"}, \"RpcUserName\": {\"default\": \"guest\", \"description\": \"The username for messaging backend\", \"type\": \"string\"}, \"RpcPassword\": {\"description\": \"The password for messaging backend\", \"type\": \"string\", \"hidden\": true}, \"RpcUseSSL\": {\"default\": false, \"description\": \"Messaging client subscriber parameter to specify an SSL connection to the messaging host.\\n\", \"type\": \"string\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"RpcCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"RabbitFIPS\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Configures RabbitMQ to run in FIPS mode\"}}, \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"RpcCertificateKeySize\"}, \"\"]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RabbitMQServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/rabbitmq/rabbitmq-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerRabbitmqImage\": \"ContainerRabbitmqImage\", \"ContainerRabbitmqConfigImage\": \"ContainerRabbitmqConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerRabbitmqImage\": {\"get_param\": \"ContainerRabbitmqImage\"}, \"ContainerRabbitmqConfigImage\": {\"get_param\": \"ContainerRabbitmqConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Rabbitmq API role.\", \"value\": {\"service_name\": \"oslo_messaging_rpc\", \"firewall_rules\": {\"109 rabbitmq\": {\"dport\": [4369, {\"get_param\": \"RpcPort\"}, 25672, \"25673-25683\"]}}, \"monitoring_subscription\": {\"get_attr\": [\"RabbitMQServiceBase\", \"role_data\", \"monitoring_subscription\"]}, \"global_config_settings\": {\"map_merge\": [{\"get_attr\": [\"RabbitMQServiceBase\", \"role_data\", \"global_config_settings\"]}, {\"oslo_messaging_rpc_scheme\": \"rabbit\", \"oslo_messaging_rpc_user_name\": {\"get_param\": \"RpcUserName\"}, \"oslo_messaging_rpc_password\": {\"get_param\": \"RpcPassword\"}, \"oslo_messaging_rpc_use_ssl\": {\"get_param\": \"RpcUseSSL\"}, \"oslo_messaging_rpc_port\": {\"get_param\": \"RpcPort\"}}]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"RabbitMQServiceBase\", \"role_data\", \"config_settings\"]}, {\"rabbitmq::default_user\": {\"get_param\": \"RpcUserName\"}, \"rabbitmq::default_pass\": {\"get_param\": \"RpcPassword\"}, \"rabbitmq::port\": {\"get_param\": \"RpcPort\"}, \"rabbitmq::interface\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OsloMessagingRpcNetwork\"]}}}}, \"rabbitmq::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::ssl_erl_dist\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::ssl_port\": {\"get_param\": \"RpcPort\"}, \"rabbitmq::ssl_only\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::ssl_interface\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OsloMessagingRpcNetwork\"]}}}}, \"tripleo::profile::base::rabbitmq::enable_internal_tls\": {\"get_param\": \"EnableInternalTLS\"}, \"rabbitmq::collect_statistics_interval\": 30000, \"rabbitmq::admin_enable\": false, \"rabbitmq::management_enable\": true, \"rabbitmq::use_config_file_for_plugins\": true, \"rabbitmq::management_ip_address\": \"127.0.0.1\", \"rabbitmq::config_management_variables\": {\"rates_mode\": \"none\"}}, {\"if\": [\"internal_tls_enabled\", {\"tripleo::rabbitmq::service_certificate\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"tripleo::certmonger::rabbitmq::postsave_cmd\": \"true\", \"tripleo::profile::base::rabbitmq::certificate_specs\": {\"service_certificate\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"service_key\": \"/etc/pki/tls/private/rabbitmq.key\"}, \"rabbitmq::ssl_versions\": {\"if\": [{\"get_param\": \"RabbitFIPS\"}, [\"tlsv1.2\", \"tlsv1.3\"], [\"tlsv1.2\"]]}}, {}]}]}, \"puppet_config\": {\"config_volume\": \"rabbitmq\", \"step_config\": {\"list_join\": [\"\\n\", [\"['Rabbitmq_policy', 'Rabbitmq_user'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::base::rabbitmq\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/rabbitmq.json\": {\"command\": \"/usr/lib/rabbitmq/bin/rabbitmq-server\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/lib/rabbitmq\", \"owner\": \"rabbitmq:rabbitmq\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"owner\": \"rabbitmq:rabbitmq\", \"optional\": true}, {\"path\": \"/etc/pki/tls/private/rabbitmq.key\", \"owner\": \"rabbitmq:rabbitmq\", \"optional\": true}]}}, \"docker_config\": {\"step_1\": {\"rabbitmq_init_logs\": {\"start_order\": 0, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/rabbitmq:/var/log/rabbitmq:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R rabbitmq:rabbitmq /var/log/rabbitmq\"]}, \"rabbitmq_bootstrap\": {\"start_order\": 1, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"host\", \"privileged\": false, \"user\": \"root\", \"command\": [\"bash\", \"-ec\", {\"list_join\": [\"\\n\", [\"kolla_set_configs\", \"if [[ -e \\\"/var/lib/rabbitmq/.erlang.cookie\\\" ]]; then rm -f /var/lib/rabbitmq/.erlang.cookie; fi\", \"hiera 'rabbitmq::erlang_cookie' > /var/lib/rabbitmq/.erlang.cookie\", \"chown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\", \"chmod 400 /var/lib/rabbitmq/.erlang.cookie\"]]}], \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq:z\", \"/var/log/containers/rabbitmq:/var/log/rabbitmq:z\"], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro\", \"/etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"rabbitmq\": {\"start_order\": 2, \"stop_grace_period\": 60, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq:z\", \"/var/log/containers/rabbitmq:/var/log/rabbitmq:z\"], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/rabbitmq.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/rabbitmq.crt:ro\", \"/etc/pki/tls/private/rabbitmq.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/rabbitmq.key:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"container_puppet_tasks\": {\"step_2\": {\"config_volume\": \"rabbit_init_tasks\", \"puppet_tags\": \"rabbitmq_policy,rabbitmq_user\", \"step_config\": \"include tripleo::profile::base::rabbitmq\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqConfigImage\"]}, \"volumes\": [\"/var/lib/config-data/puppet-generated/rabbitmq/etc/rabbitmq:/etc/rabbitmq:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq:z\"]}}, \"metadata_settings\": {\"if\": [\"internal_tls_enabled\", [{\"service\": \"rabbitmq\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"OsloMessagingRpcNetwork\"]}, \"type\": \"node\"}], null]}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"rabbitmq\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OsloMessagingRpcNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"rabbitmq/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OsloMessagingRpcNetwork\"]}}}}, \"run_after\": \"container_name=$({{container_cli}} ps --format=\\\\{\\\\{.Names\\\\}\\\\} | grep -w -E 'rabbitmq(-bundle-.*-[0-9]+)?')\\nservice_crt=\\\"/etc/pki/tls/certs/rabbitmq.crt\\\"\\nservice_key=\\\"/etc/pki/tls/private/rabbitmq.key\\\"\\nif echo \\\"$container_name\\\" | grep -q \\\"^rabbitmq-bundle\\\"; then\\n  # lp#1917868: Do not use podman cp with HA containers as they get\\n  # frozen temporarily and that can make pacemaker operation fail.\\n  tar -c \\\"$service_crt\\\" \\\"$service_key\\\" | {{container_cli}} exec -i \\\"$container_name\\\" tar -C / -xv\\n  # no need to update the mount point, because pacemaker\\n  # recreates the container when it's restarted\\nelse\\n  # Refresh the cert at the mount-point\\n  {{container_cli}} cp $service_crt \\\"$container_name:/var/lib/kolla/config_files/src-tls/$service_crt\\\"\\n  # Refresh the key at the mount-point\\n  {{container_cli}} cp $service_key \\\"$container_name:/var/lib/kolla/config_files/src-tls/$service_key\\\"\\n  # Copy the new cert from the mount-point to the real path\\n  {{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_crt\\\" \\\"$service_crt\\\"\\n  # Copy the new key from the mount-point to the real path\\n  {{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_key\\\" \\\"$service_key\\\"\\nfi\\n# Set appropriate permissions\\n{{container_cli}} exec -u root \\\"$container_name\\\" chown rabbitmq:rabbitmq \\\"$service_crt\\\"\\n{{container_cli}} exec -u root \\\"$container_name\\\" chown rabbitmq:rabbitmq \\\"$service_key\\\"\\n# Trigger a pem cache clear in RabbitMQ to read the new certificates\\n{{container_cli}} exec \\\"$container_name\\\" rabbitmqctl eval \\\"ssl:clear_pem_cache().\\\"\\n\", \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"RpcCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], \"host_prep_tasks\": [{\"name\": \"create fcontext for rabbitmq data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/rabbitmq(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/rabbitmq\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/rabbitmq\", \"setype\": \"container_file_t\"}]}], \"upgrade_tasks\": [], \"update_tasks\": null}}}}", "file:///root/tripleo-heat-installer-templates/deployment/rabbitmq/rabbitmq-messaging-rpc-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Rabbitmq service\\n\", \"parameters\": {\"ContainerRabbitmqImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerRabbitmqConfigImage\": {\"description\": \"The container image to use for the rabbitmq config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RabbitCookie\": {\"type\": \"string\", \"default\": \"\", \"hidden\": true}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}}, \"conditions\": {\"puppet_debug_enabled\": {\"get_param\": \"ConfigDebug\"}, \"docker_enabled\": {\"equals\": [{\"get_param\": \"ContainerCli\"}, \"docker\"]}, \"common_tag_enabled\": {\"equals\": [{\"get_param\": \"ClusterCommonTag\"}, true]}, \"common_tag_full\": {\"equals\": [{\"get_param\": \"ClusterFullTag\"}, true]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RabbitmqBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/rabbitmq/rabbitmq-messaging-rpc-container-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerRabbitmqImage\": \"ContainerRabbitmqImage\", \"ContainerRabbitmqConfigImage\": \"ContainerRabbitmqConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerRabbitmqImage\": {\"get_param\": \"ContainerRabbitmqImage\"}, \"ContainerRabbitmqConfigImage\": {\"get_param\": \"ContainerRabbitmqConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Rabbitmq API role.\", \"value\": {\"service_name\": {\"get_attr\": [\"RabbitmqBase\", \"role_data\", \"service_name\"]}, \"firewall_rules\": {\"109 rabbitmq-bundle\": {\"dport\": [3122, 4369, 5672, 25672, \"25673-25683\"]}}, \"global_config_settings\": {\"get_attr\": [\"RabbitmqBase\", \"role_data\", \"global_config_settings\"]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"RabbitmqBase\", \"role_data\", \"config_settings\"]}, {\"rabbitmq::service_manage\": false, \"tripleo::profile::pacemaker::rabbitmq_bundle::rabbitmq_docker_image\": {\"if\": [\"common_tag_full\", \"cluster.common.tag/rabbitmq:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [\"common_tag_enabled\", {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"tripleo::profile::pacemaker::rabbitmq_bundle::control_port\": 3122, \"tripleo::profile::pacemaker::rabbitmq_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::rabbitmq_bundle::force_ocf\": true}]}, \"service_config_settings\": {\"get_attr\": [\"RabbitmqBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"rabbitmq\", \"puppet_tags\": \"file,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"['Rabbitmq_policy', 'Rabbitmq_user'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::pacemaker::rabbitmq_bundle\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/rabbitmq.json\": {\"command\": \"/usr/sbin/pacemaker_remoted\", \"config_files\": [{\"dest\": \"/etc/libqb/force-filesystem-sockets\", \"source\": \"/dev/null\", \"owner\": \"root\", \"perm\": \"0644\"}, {\"dest\": \"/var/log/btmp\", \"source\": \"/dev/null\", \"owner\": \"root:utmp\", \"perm\": \"0600\"}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"optional\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/lib/rabbitmq\", \"owner\": \"rabbitmq:rabbitmq\", \"recurse\": true}, {\"path\": \"/var/log/rabbitmq\", \"owner\": \"rabbitmq:rabbitmq\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/rabbitmq.crt\", \"owner\": \"rabbitmq:rabbitmq\", \"perm\": \"0600\", \"optional\": true}, {\"path\": \"/etc/pki/tls/private/rabbitmq.key\", \"owner\": \"rabbitmq:rabbitmq\", \"perm\": \"0600\", \"optional\": true}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_1\": {\"rabbitmq_bootstrap\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"net\": \"host\", \"privileged\": false, \"user\": \"root\", \"command\": [\"bash\", \"-ec\", {\"list_join\": [\"\\n\", [\"kolla_set_configs\", \"if [[ -e \\\"/var/lib/rabbitmq/.erlang.cookie\\\" ]]; then rm -f /var/lib/rabbitmq/.erlang.cookie; fi\", \"hiera 'rabbitmq::erlang_cookie' > /var/lib/rabbitmq/.erlang.cookie\", \"chown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\", \"chmod 400 /var/lib/rabbitmq/.erlang.cookie\"]]}], \"volumes\": [\"/var/lib/kolla/config_files/rabbitmq.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/rabbitmq:/var/lib/kolla/config_files/src:ro\", \"/etc/hosts:/etc/hosts:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/var/lib/rabbitmq:/var/lib/rabbitmq:z\", \"/etc/puppet:/etc/puppet:ro,z\"], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_2\": {\"rabbitmq_wait_bundle\": {\"start_order\": 0, \"detach\": false, \"net\": \"host\", \"ipc\": \"host\", \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"2\", \"file,file_line,concat,augeas,rabbitmq_policy,rabbitmq_user,rabbitmq_ready\", \"include tripleo::profile::pacemaker::rabbitmq_bundle\"], {\"if\": [\"puppet_debug_enabled\", [\"--debug\"], [\"\"]]}]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/bin/true:/bin/epmd\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"KOLLA_BOOTSTRAP\": true, \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}}, \"metadata_settings\": {\"get_attr\": [\"RabbitmqBase\", \"role_data\", \"metadata_settings\"]}, \"host_prep_tasks\": [{\"name\": \"create fcontext for rabbitmq data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/rabbitmq(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/lib/rabbitmq\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/log/containers/rabbitmq\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"stop the Erlang port mapper on the host and make sure it cannot bind to the port used by container\", \"shell\": \"echo 'export ERL_EPMD_ADDRESS=127.0.0.1' > /etc/rabbitmq/rabbitmq-env.conf\\necho 'export ERL_EPMD_PORT=4370' >> /etc/rabbitmq/rabbitmq-env.conf\\nfor pid in $(pgrep epmd --ns 1 --nslist pid); do kill $pid; done\\n\"}], \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"RabbitmqBase\", \"role_data\", \"deploy_steps_tasks\"]}, [{\"name\": \"RabbitMQ tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"container_image_latest\": {\"if\": [\"common_tag_full\", \"cluster.common.tag/rabbitmq:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [\"common_tag_enabled\", {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"RabbitMQ RPC HA Wrappers Step\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Rabbitmq rpc puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"oslo_messaging_rpc\", \"tripleo_ha_wrapper_resource_name\": \"rabbitmq\", \"tripleo_ha_wrapper_bundle_name\": \"rabbitmq-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"rabbitmq\", \"tripleo_ha_wrapper_puppet_execute\": \"[\\\"Rabbitmq_policy\\\", \\\"Rabbitmq_user\\\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::rabbitmq_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}]}]]}, \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get rabbitmq image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_rabbitmq_rpc_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container rabbitmq image\", \"set_fact\": {\"rabbitmq_rpc_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"rabbitmq_rpc_image_latest\": {\"if\": [\"common_tag_full\", \"cluster.common.tag/rabbitmq:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [\"common_tag_enabled\", {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_rabbitmq_rpc_image\": \"{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"oslo_messaging_rpc\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"rabbitmq temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"oslo_messaging_rpc\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"rabbitmq-bundle\", \"tripleo_ha_image_update_new_image\": \"{{rabbitmq_rpc_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_rabbitmq_rpc_image}}\"}, \"when\": [\"(pcmk_rabbitmq_rpc_image != \\\"\\\")\", \"(pcmk_rabbitmq_rpc_image != rabbitmq_rpc_image_latest)\"]}]}], \"update_tasks\": [{\"block\": [{\"name\": \"Get rabbitmq image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_rabbitmq_rpc_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container rabbitmq image\", \"set_fact\": {\"rabbitmq_rpc_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"rabbitmq_rpc_image_latest\": {\"if\": [\"common_tag_full\", \"cluster.common.tag/rabbitmq:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [\"common_tag_enabled\", {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_rabbitmq_rpc_image\": \"{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of rabbitmq container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_rabbitmq_rpc_image == rabbitmq_rpc_image_latest\", \"fail_msg\": \"rabbitmq image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"Tear-down non-HA rabbitmq container\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Remove non-HA rabbitmq container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"rabbitmq\"]}}]}, {\"name\": \"Rabbitmq fetch and retag container image for pacemaker\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Retag pcmklatest to latest rabbitmq image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{rabbitmq_rpc_image}}\", \"container_image_latest\": \"{{rabbitmq_rpc_image_latest}}\"}}]}], \"post_update_tasks\": [{\"name\": \"Rabbitmq rpc bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Rabbitmq rpc puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"oslo_messaging_rpc\", \"tripleo_ha_wrapper_resource_name\": \"rabbitmq\", \"tripleo_ha_wrapper_bundle_name\": \"rabbitmq-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"rabbitmq\", \"tripleo_ha_wrapper_puppet_execute\": \"[\\\"Rabbitmq_policy\\\", \\\"Rabbitmq_user\\\"].each |String $val| { noop_resource($val) }; include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::rabbitmq_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}], \"upgrade_tasks\": [{\"name\": \"Tear-down non-HA rabbitmq container\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Remove non-HA rabbitmq container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"rabbitmq\"]}}]}, {\"name\": \"Prepare switch of rabbitmq image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get rabbitmq image id currently used by pacemaker\", \"shell\": \"pcs resource config rabbitmq-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"rabbitmq_rpc_image_current_res\", \"failed_when\": false}, {\"name\": \"Image facts for rabbitmq\", \"set_fact\": {\"rabbitmq_rpc_image_latest\": {\"if\": [\"common_tag_full\", \"cluster.common.tag/rabbitmq:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [\"common_tag_enabled\", {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"rabbitmq_rpc_image_current\": \"{{rabbitmq_rpc_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current rabbitmq image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{rabbitmq_rpc_image_current}}\", \"container_image_latest\": \"{{rabbitmq_rpc_image_latest}}\", \"pull_image\": false}, \"when\": [\"rabbitmq_rpc_image_current != ''\", \"rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest\"]}, {\"name\": \"Create rabbitmq_rpc retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/rabbitmq_rpc_needs_retag\", \"state\": \"touch\"}, \"when\": [\"rabbitmq_rpc_image_current != ''\", \"rabbitmq_rpc_image_current != rabbitmq_rpc_image_latest\"]}]}, {\"name\": \"Update rabbitmq-bundle pcs resource bundle for new container image\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"set is_rpc_rabbitmq_bootstrap_node fact\", \"set_fact\": \"is_rpc_rabbitmq_bootstrap_node={{oslo_messaging_rpc_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}, {\"name\": \"Check for rabbitmq_rpc retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/rabbitmq_rpc_needs_retag\"}, \"register\": \"rabbitmq_rpc_retag_state_file\"}]}, {\"name\": \"Update rabbitmq-bundle pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_rpc_rabbitmq_bootstrap_node|bool\", \"rabbitmq_rpc_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the rabbitmq cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"rabbitmq-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Check rabbitmq logging configuration in pacemaker\", \"command\": \"cibadmin --query --xpath \\\"//storage-mapping[@id='rabbitmq-log']\\\"\", \"failed_when\": false, \"register\": \"rabbitmq_logs_moved\"}, {\"name\": \"Add a bind mount for logging in the rabbitmq bundle\", \"when\": \"rabbitmq_logs_moved.rc == 6\", \"command\": \"pcs resource bundle update rabbitmq-bundle storage-map add id=rabbitmq-log source-dir=/var/log/containers/rabbitmq target-dir=/var/log/rabbitmq options=rw\"}, {\"name\": \"Update the rabbitmq bundle to use the new container image name\", \"command\": \"pcs resource bundle update rabbitmq-bundle container image={{rabbitmq_rpc_image_latest}}\"}, {\"name\": \"Enable the rabbitmq cluster resource\", \"pacemaker_resource\": {\"resource\": \"rabbitmq-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}, {\"name\": \"Check for rabbitmq_rpc retag statefile\", \"when\": [\"step|int == 3\"], \"stat\": {\"path\": \"/var/lib/tripleo/rabbitmq_rpc_needs_retag\"}, \"register\": \"rabbitmq_rpc_retag_state_file\"}, {\"name\": \"Retag rabbitmq-bundle container image\", \"when\": [\"step|int == 3\", \"rabbitmq_rpc_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the rabbitmq cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"rabbitmq-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Retag the pacemaker image if containerized\", \"block\": [{\"block\": [{\"name\": \"Get rabbitmq image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_rabbitmq_rpc_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='rabbitmq-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container rabbitmq image\", \"set_fact\": {\"rabbitmq_rpc_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"rabbitmq_rpc_image_latest\": {\"if\": [\"common_tag_full\", \"cluster.common.tag/rabbitmq:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [\"common_tag_enabled\", {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRabbitmqImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_rabbitmq_rpc_image\": \"{{xmllint_pcmk_rabbitmq_rpc_image.stdout}}\"}}]}, {\"block\": [{\"name\": \"Retag pcmklatest to latest rabbitmq image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{rabbitmq_rpc_image}}\", \"container_image_latest\": \"{{rabbitmq_rpc_image_latest}}\"}}]}]}, {\"name\": \"Enable the rabbitmq cluster resource\", \"pacemaker_resource\": {\"resource\": \"rabbitmq-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Remove rabbitmq_rpc retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/rabbitmq_rpc_needs_retag\", \"state\": \"absent\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/rabbitmq/rabbitmq-messaging-notify-shared-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Oslo Notify using a shared OpenStack containerized Rabbitmq service\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"RpcPort\": {\"default\": 5672, \"description\": \"The network port for messaging backend\", \"type\": \"number\"}, \"RpcUserName\": {\"default\": \"guest\", \"description\": \"The username for messaging backend\", \"type\": \"string\"}, \"RpcPassword\": {\"description\": \"The password for messaging backend\", \"type\": \"string\", \"hidden\": true}, \"RpcUseSSL\": {\"default\": false, \"description\": \"Messaging client subscriber parameter to specify an SSL connection to the messaging host.\\n\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the oslo messaging notify role.\", \"value\": {\"service_name\": \"oslo_messaging_notify\", \"global_config_settings\": {\"oslo_messaging_notify_scheme\": \"rabbit\", \"oslo_messaging_notify_user_name\": {\"get_param\": \"RpcUserName\"}, \"oslo_messaging_notify_password\": {\"get_param\": \"RpcPassword\"}, \"oslo_messaging_notify_use_ssl\": {\"get_param\": \"RpcUseSSL\"}, \"oslo_messaging_notify_port\": {\"get_param\": \"RpcPort\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/haproxy/haproxy-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized HAproxy service\\n\", \"parameters\": {\"ContainerHAProxyImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerHAProxyConfigImage\": {\"description\": \"The container image to use for the haproxy config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"HAProxyStatsPassword\": {\"description\": \"Password for HAProxy stats endpoint\", \"hidden\": true, \"type\": \"string\"}, \"HAProxyStatsUser\": {\"description\": \"User for HAProxy stats endpoint\", \"default\": \"admin\", \"type\": \"string\"}, \"HAProxyLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.haproxy\", \"file\": \"/var/log/containers/haproxy/haproxy.log\", \"startmsg.regex\": \"^[a-zA-Z]{3} [ 123][0-9] [:0-9]{8}\"}}, \"HAProxySyslogAddress\": {\"default\": \"/dev/log\", \"description\": \"Syslog address where HAproxy will send its log\", \"type\": \"string\"}, \"HAProxySyslogFacility\": {\"default\": \"local0\", \"description\": \"Syslog facility HAProxy will use for its logs\", \"type\": \"string\"}, \"SSLCertificate\": {\"default\": \"\", \"description\": \"The content of the SSL certificate (without Key) in PEM format.\\n\", \"type\": \"string\"}, \"PublicSSLCertificateAutogenerated\": {\"default\": false, \"description\": \"Whether the public SSL certificate was autogenerated or not.\\n\", \"type\": \"boolean\"}, \"EnablePublicTLS\": {\"default\": true, \"description\": \"Whether to enable TLS on the public interface or not.\\n\", \"type\": \"boolean\"}, \"DeployedSSLCertificatePath\": {\"default\": \"/etc/pki/tls/private/overcloud_endpoint.pem\", \"description\": \"The filepath of the certificate as it will be stored in the controller.\\n\", \"type\": \"string\"}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}, \"MonitoringSubscriptionHaproxy\": {\"default\": \"overcloud-haproxy\", \"type\": \"string\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"EnableLoadBalancer\": {\"default\": true, \"description\": \"Whether to deploy a LoadBalancer, set to false when an external load balancer is used.\", \"type\": \"boolean\"}, \"HAProxyStatsEnabled\": {\"default\": true, \"description\": \"Whether or not to enable the HAProxy stats interface.\", \"type\": \"boolean\"}, \"InternalTLSCRLPEMFile\": {\"default\": \"/etc/pki/CA/crl/overcloud-crl.pem\", \"type\": \"string\", \"description\": \"Specifies the default CRL PEM file to use for revocation if TLS is used for services in the internal network.\"}, \"InternalTLSCRLPEMDir\": {\"default\": \"/etc/pki/CA/crl/\", \"type\": \"string\", \"description\": \"The directory of the CRL PEM file to be mounted.\"}}, \"conditions\": {\"public_tls_enabled\": {\"and\": [{\"get_param\": \"EnablePublicTLS\"}, {\"or\": [{\"not\": {\"equals\": [{\"get_param\": \"SSLCertificate\"}, \"\"]}}, {\"get_param\": \"PublicSSLCertificateAutogenerated\"}]}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"HAProxyLogging\": {\"type\": \"OS::TripleO::Services::Logging::HAProxy\"}, \"HAProxyPublicTLS\": {\"type\": \"OS::TripleO::Services::HAProxyPublicTLS\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"HAProxyInternalTLS\": {\"type\": \"OS::TripleO::Services::HAProxyInternalTLS\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHAProxyImage\": \"ContainerHAProxyImage\", \"ContainerHAProxyConfigImage\": \"ContainerHAProxyConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHAProxyImage\": {\"get_param\": \"ContainerHAProxyImage\"}, \"ContainerHAProxyConfigImage\": {\"get_param\": \"ContainerHAProxyConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the HAproxy role.\", \"value\": {\"service_name\": \"haproxy\", \"firewall_rules\": {\"107 haproxy stats\": {\"dport\": 1993}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionHaproxy\"}, \"ansible_group_vars\": {\"tripleo_firewall_frontend_enabled\": true, \"tripleo_firewall_ssl_frontend_enabled\": {\"if\": [\"public_tls_enabled\", true]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"HAProxyLogging\", \"config_settings\"]}, {\"tripleo::haproxy::haproxy_service_manage\": false, \"tripleo::haproxy::haproxy_log_address\": {\"get_param\": \"HAProxySyslogAddress\"}, \"tripleo::haproxy::haproxy_log_facility\": {\"get_param\": \"HAProxySyslogFacility\"}, \"tripleo::haproxy::haproxy_stats_user\": {\"get_param\": \"HAProxyStatsUser\"}, \"tripleo::haproxy::haproxy_stats_password\": {\"get_param\": \"HAProxyStatsPassword\"}, \"tripleo::haproxy::haproxy_stats_bind_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HaproxyNetwork\"]}}}}, \"tripleo::haproxy::redis_password\": {\"get_param\": \"RedisPassword\"}, \"tripleo::haproxy::crl_file\": null, \"tripleo::haproxy::haproxy_stats\": {\"get_param\": \"HAProxyStatsEnabled\"}, \"enable_load_balancer\": {\"get_param\": \"EnableLoadBalancer\"}, \"tripleo::profile::base::haproxy::certificates_specs\": {\"map_merge\": [{\"get_attr\": [\"HAProxyPublicTLS\", \"role_data\", \"certificates_specs\"]}, {\"get_attr\": [\"HAProxyInternalTLS\", \"role_data\", \"certificates_specs\"]}]}, \"tripleo::haproxy::service_certificate\": {\"if\": [\"public_tls_enabled\", {\"get_param\": \"DeployedSSLCertificatePath\"}]}, \"tripleo::haproxy::ca_bundle\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"InternalTLSCAFile\"}]}}, {\"get_attr\": [\"HAProxyPublicTLS\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"HAProxyInternalTLS\", \"role_data\", \"config_settings\"]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_haproxy\": [{\"get_param\": \"HAProxyLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"haproxy\", \"puppet_tags\": \"haproxy_config\", \"step_config\": \"class {'tripleo::profile::base::haproxy': manage_firewall => false}\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyConfigImage\"]}, \"volumes\": {\"list_concat\": [{\"if\": [\"public_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"DeployedSSLCertificatePath\"}, {\"get_param\": \"DeployedSSLCertificatePath\"}, \"ro,shared\"]]}]]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/haproxy:/etc/pki/tls/certs/haproxy:ro,shared\", \"/etc/pki/tls/private/haproxy:/etc/pki/tls/private/haproxy:ro,shared\", {\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"InternalTLSCAFile\"}, \"ro,shared\"]]}, {\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCRLPEMDir\"}, {\"get_param\": \"InternalTLSCRLPEMDir\"}, \"ro,shared\"]]}]]}]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/haproxy.json\": {\"command\": \"bash -c $* -- eval if [ -f /usr/sbin/haproxy-systemd-wrapper ]; then exec /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg; else exec /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -Ws; fi\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/lib/haproxy\", \"owner\": \"haproxy:haproxy\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/haproxy\", \"owner\": \"haproxy:haproxy\", \"recurse\": true, \"optional\": true}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_1\": {\"map_merge\": [{\"get_attr\": [\"HAProxyLogging\", \"docker_config\", \"step_1\"]}, {\"haproxy\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"net\": \"host\", \"restart\": \"always\", \"security_opt\": [\"label=disable\"], \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"HAProxyLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/haproxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/haproxy:/var/lib/kolla/config_files/src:ro\", \"/var/lib/haproxy:/var/lib/haproxy:rw,z\"], {\"if\": [\"public_tls_enabled\", [{\"list_join\": [\":\", [{\"get_param\": \"DeployedSSLCertificatePath\"}, {\"list_join\": [\"\", [\"/var/lib/kolla/config_files/src-tls\", {\"get_param\": \"DeployedSSLCertificatePath\"}]]}, \"ro,shared\"]]}]]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/haproxy:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/haproxy:ro,shared\", \"/etc/pki/tls/private/haproxy:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/haproxy:ro,shared\", {\"list_join\": [\":\", [{\"get_param\": \"InternalTLSCRLPEMDir\"}, {\"get_param\": \"InternalTLSCRLPEMDir\"}, \"ro\"]]}]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}}, \"deploy_steps_tasks\": {\"list_concat\": [[{\"name\": \"Configure rsyslog for HAproxy container\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Check if rsyslog exists\", \"shell\": \"systemctl is-active rsyslog\", \"register\": \"rsyslog_config\"}, {\"when\": [\"rsyslog_config is changed\", \"rsyslog_config.rc == 0\"], \"block\": [{\"name\": \"Forward logging to haproxy.log file\", \"blockinfile\": {\"content\": \"if $syslogfacility-text == '{{facility}}' and $programname == 'haproxy' then -/var/log/containers/haproxy/haproxy.log\\n& stop\\n\", \"create\": true, \"path\": \"/etc/rsyslog.d/openstack-haproxy.conf\"}, \"vars\": {\"facility\": {\"get_param\": \"HAProxySyslogFacility\"}}, \"register\": \"logconfig\"}, {\"name\": \"restart rsyslog service after logging conf change\", \"service\": {\"name\": \"rsyslog\", \"state\": \"restarted\"}, \"when\": \"logconfig is changed\"}]}]}, {\"name\": \"Run puppet on the host to apply IPtables rules\", \"no_log\": true, \"when\": \"step|int == 1\", \"register\": \"puppet_host_outputs\", \"shell\": \"puppet apply {{ (puppet_debug|bool) | ternary('--debug --verbose', '') }} --detailed-exitcodes --summarize --color=false \\\\\\n    --modulepath '{{ puppet_modulepath }}' --tags '{{ puppet_tags }}' -e '{{ puppet_execute }}'\\n\", \"changed_when\": \"puppet_host_outputs.rc == 2\", \"failed_when\": false, \"vars\": {\"puppet_execute\": \"include tripleo::profile::base::haproxy\", \"puppet_tags\": \"tripleo::firewall::rule\", \"puppet_modulepath\": \"/etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules\", \"puppet_debug\": {\"get_param\": \"ConfigDebug\"}}}, {\"name\": \"Debug output for task: Run puppet on the host to apply IPtables rules\", \"debug\": {\"var\": \"puppet_host_outputs.stdout_lines | default([]) | union(puppet_host_outputs.stderr_lines | default([]))\"}, \"when\": [\"not (ansible_check_mode | bool)\", \"puppet_host_outputs.rc is defined\"], \"failed_when\": \"puppet_host_outputs.rc not in [0, 2]\"}], {\"if\": [\"public_tls_enabled\", {\"get_attr\": [\"HAProxyPublicTLS\", \"role_data\", \"deploy_steps_tasks\"]}]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_attr\": [\"HAProxyInternalTLS\", \"role_data\", \"deploy_steps_tasks\"]}]}]}, \"upgrade_tasks\": [{\"name\": \"ensure we have haproxy log dir with the correct setype\", \"file\": {\"path\": \"/var/log/containers/haproxy\", \"state\": \"directory\", \"setype\": \"var_log_t\", \"recurse\": true}, \"when\": \"step|int == 1\"}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop haproxy container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"haproxy\"], \"tripleo_delegate_to\": \"{{ groups['haproxy'] | difference(groups['excluded_overcloud']) }}\"}}]}], \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"HAProxyPublicTLS\", \"role_data\", \"host_prep_tasks\"]}, [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/haproxy\", \"setype\": \"var_log_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/haproxy\", \"setype\": \"container_file_t\"}]}]]}, \"metadata_settings\": {\"list_concat\": [{\"get_attr\": [\"HAProxyPublicTLS\", \"role_data\", \"metadata_settings\"]}, {\"get_attr\": [\"HAProxyInternalTLS\", \"role_data\", \"metadata_settings\"]}]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/haproxy/haproxy-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized HAproxy service for pacemaker\\n\", \"parameters\": {\"ContainerHAProxyImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerHAProxyConfigImage\": {\"description\": \"The container image to use for the haproxy config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"SSLCertificate\": {\"default\": \"\", \"description\": \"The content of the SSL certificate (without Key) in PEM format.\\n\", \"type\": \"string\"}, \"PublicSSLCertificateAutogenerated\": {\"default\": false, \"description\": \"Whether the public SSL certificate was autogenerated or not.\\n\", \"type\": \"boolean\"}, \"EnablePublicTLS\": {\"default\": true, \"description\": \"Whether to enable TLS on the public interface or not.\\n\", \"type\": \"boolean\"}, \"DeployedSSLCertificatePath\": {\"default\": \"/etc/pki/tls/private/overcloud_endpoint.pem\", \"description\": \"The filepath of the certificate as it will be stored in the controller.\\n\", \"type\": \"string\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"HAProxyInternalTLSCertsDirectory\": {\"default\": \"/etc/pki/tls/certs/haproxy\", \"type\": \"string\"}, \"HAProxyInternalTLSKeysDirectory\": {\"default\": \"/etc/pki/tls/private/haproxy\", \"type\": \"string\"}, \"HAProxyLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.haproxy\", \"file\": \"/var/log/containers/haproxy/haproxy.log\", \"startmsg.regex\": \"^[a-zA-Z]{3} [ 123][0-9] [:0-9]{8}\"}}, \"HAProxySyslogAddress\": {\"default\": \"/dev/log\", \"description\": \"Syslog address where HAproxy will send its log\", \"type\": \"string\"}, \"HAProxySyslogFacility\": {\"default\": \"local0\", \"description\": \"Syslog facility HAProxy will use for its logs\", \"type\": \"string\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}}, \"conditions\": {\"public_tls_enabled\": {\"and\": [{\"get_param\": \"EnablePublicTLS\"}, {\"or\": [{\"not\": {\"equals\": [{\"get_param\": \"SSLCertificate\"}, \"\"]}}, {\"get_param\": \"PublicSSLCertificateAutogenerated\"}]}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"HAProxyBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/haproxy/haproxy-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"HAProxyPublicTLS\": {\"type\": \"OS::TripleO::Services::HAProxyPublicTLS\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"HAProxyInternalTLS\": {\"type\": \"OS::TripleO::Services::HAProxyInternalTLS\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHAProxyImage\": \"ContainerHAProxyImage\", \"ContainerHAProxyConfigImage\": \"ContainerHAProxyConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHAProxyImage\": {\"get_param\": \"ContainerHAProxyImage\"}, \"ContainerHAProxyConfigImage\": {\"get_param\": \"ContainerHAProxyConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the HAproxy role.\", \"value\": {\"service_name\": \"haproxy\", \"firewall_rules\": {\"get_attr\": [\"HAProxyBase\", \"role_data\", \"firewall_rules\"]}, \"monitoring_subscription\": {\"get_attr\": [\"HAProxyBase\", \"role_data\", \"monitoring_subscription\"]}, \"ansible_group_vars\": {\"get_attr\": [\"HAProxyBase\", \"role_data\", \"ansible_group_vars\"]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"HAProxyBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::haproxy::haproxy_service_manage\": false, \"tripleo::haproxy::mysql_clustercheck\": true, \"tripleo::haproxy::haproxy_log_address\": {\"get_param\": \"HAProxySyslogAddress\"}, \"tripleo::haproxy::haproxy_log_facility\": {\"get_param\": \"HAProxySyslogFacility\"}}, {\"haproxy_docker\": true, \"tripleo::profile::pacemaker::haproxy_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::haproxy_bundle::tls_mapping\": {\"list_concat\": [{\"if\": [\"public_tls_enabled\", [{\"get_param\": \"DeployedSSLCertificatePath\"}]]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"HAProxyInternalTLSKeysDirectory\"}, {\"get_param\": \"HAProxyInternalTLSCertsDirectory\"}]]}]}, \"tripleo::profile::pacemaker::haproxy_bundle::tls_mapping_init_bundle\": {\"list_concat\": [{\"if\": [\"public_tls_enabled\", [{\"get_param\": \"DeployedSSLCertificatePath\"}]]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"get_param\": \"HAProxyInternalTLSKeysDirectory\"}, {\"get_param\": \"HAProxyInternalTLSCertsDirectory\"}]]}]}, \"tripleo::profile::pacemaker::haproxy_bundle::internal_certs_directory\": {\"get_param\": \"HAProxyInternalTLSCertsDirectory\"}, \"tripleo::profile::pacemaker::haproxy_bundle::internal_keys_directory\": {\"get_param\": \"HAProxyInternalTLSKeysDirectory\"}, \"tripleo::profile::pacemaker::haproxy_bundle::haproxy_docker_image\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/haproxy:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_haproxy\": [{\"get_param\": \"HAProxyLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"haproxy\", \"puppet_tags\": \"haproxy_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"exec {'wait-for-settle': command => '/bin/true' }\", \"class tripleo::firewall(){}; define tripleo::firewall::rule( $port = undef, $dport = undef, $sport = undef, $proto = undef, $action = undef, $state = undef, $source = undef, $iniface = undef, $chain = undef, $destination = undef, $extras = undef){}\", \"['pcmk_bundle', 'pcmk_resource', 'pcmk_property', 'pcmk_constraint', 'pcmk_resource_default'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::pacemaker::haproxy_bundle\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyConfigImage\"]}, \"volumes\": {\"yaql\": {\"expression\": \"$.data.select($+\\\":\\\"+$+\\\":ro\\\")\", \"data\": {\"list_concat\": [{\"if\": [\"public_tls_enabled\", [{\"get_param\": \"DeployedSSLCertificatePath\"}]]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"get_param\": \"InternalTLSCAFile\"}, {\"get_param\": \"HAProxyInternalTLSKeysDirectory\"}, {\"get_param\": \"HAProxyInternalTLSCertsDirectory\"}]]}]}}}}, \"kolla_config\": {\"/var/lib/kolla/config_files/haproxy.json\": {\"command\": \"bash -c $* -- eval if [ -f /usr/sbin/haproxy-systemd-wrapper ]; then exec /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg; else exec /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -Ws; fi\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"optional\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/lib/haproxy\", \"owner\": \"haproxy:haproxy\", \"recurse\": true}, {\"path\": {\"list_join\": [\"\", [{\"get_param\": \"HAProxyInternalTLSCertsDirectory\"}, \"/*\"]]}, \"owner\": \"haproxy:haproxy\", \"perm\": \"0600\", \"optional\": true}, {\"path\": {\"list_join\": [\"\", [{\"get_param\": \"HAProxyInternalTLSKeysDirectory\"}, \"/*\"]]}, \"owner\": \"haproxy:haproxy\", \"perm\": \"0600\", \"optional\": true}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"HAProxyBase\", \"role_data\", \"host_prep_tasks\"]}, [{\"name\": \"Run puppet on the host to apply IPtables rules\", \"no_log\": true, \"shell\": \"puppet apply {{ (puppet_debug|bool) | ternary('--debug --verbose', '') }} --detailed-exitcodes --summarize --color=false \\\\\\n    --modulepath '{{ puppet_modulepath }}' --tags '{{ puppet_tags }}' -e '{{ puppet_execute }}'\\n\", \"register\": \"puppet_host_outputs\", \"changed_when\": \"puppet_host_outputs.rc == 2\", \"failed_when\": false, \"vars\": {\"puppet_execute\": \"if hiera('enable_load_balancer', true) { class {'::tripleo::haproxy': use_internal_certificates => false, manage_firewall => hiera('tripleo::firewall::manage_firewall', true), }}\", \"puppet_tags\": \"tripleo::firewall::rule\", \"puppet_modulepath\": \"/etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules\", \"puppet_debug\": {\"get_param\": \"ConfigDebug\"}}}, {\"name\": \"Debug output for task: Run puppet on the host to apply IPtables rules\", \"debug\": {\"var\": \"puppet_host_outputs.stdout_lines | default([]) | union(puppet_host_outputs.stderr_lines | default([]))\"}, \"when\": [\"not (ansible_check_mode | bool)\", \"puppet_host_outputs.rc is defined\"], \"failed_when\": \"puppet_host_outputs.rc not in [0, 2]\"}]]}, \"metadata_settings\": {\"get_attr\": [\"HAProxyBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"list_concat\": [[{\"name\": \"Configure rsyslog for HAproxy container managed by Pacemaker\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Check if rsyslog exists\", \"shell\": \"systemctl is-active rsyslog\", \"register\": \"rsyslog_config\"}, {\"when\": [\"rsyslog_config is changed\", \"rsyslog_config.rc == 0\"], \"block\": [{\"name\": \"Forward logging to haproxy.log file\", \"blockinfile\": {\"content\": \"if $syslogfacility-text == '{{facility}}' and $programname == 'haproxy' then -/var/log/containers/haproxy/haproxy.log\\n& stop\\n\", \"create\": true, \"path\": \"/etc/rsyslog.d/openstack-haproxy.conf\"}, \"vars\": {\"facility\": {\"get_param\": \"HAProxySyslogFacility\"}}, \"register\": \"logconfig\"}, {\"name\": \"restart rsyslog service after logging conf change\", \"service\": {\"name\": \"rsyslog\", \"state\": \"restarted\"}, \"when\": \"logconfig is changed\"}]}]}, {\"name\": \"HAproxy tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"container_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/haproxy:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"HAproxy HA Wrappers Step\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"HAproxy puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"haproxy\", \"tripleo_ha_wrapper_resource_name\": \"haproxy-bundle\", \"tripleo_ha_wrapper_bundle_name\": \"haproxy-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"haproxy\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::haproxy_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}]}], {\"if\": [\"public_tls_enabled\", {\"get_attr\": [\"HAProxyPublicTLS\", \"role_data\", \"deploy_steps_tasks\"]}, []]}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_attr\": [\"HAProxyInternalTLS\", \"role_data\", \"deploy_steps_tasks\"]}]}]}, \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get haproxy image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_haproxy_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='haproxy-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container haproxy image\", \"set_fact\": {\"haproxy_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"haproxy_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/haproxy:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_haproxy_image\": \"{{xmllint_pcmk_haproxy_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"haproxy\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"haproxy temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"haproxy\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"haproxy-bundle\", \"tripleo_ha_image_update_new_image\": \"{{haproxy_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_haproxy_image}}\"}, \"when\": [\"(pcmk_haproxy_image != \\\"\\\")\", \"(pcmk_haproxy_image != haproxy_image_latest)\"]}]}], \"update_tasks\": [{\"block\": [{\"name\": \"Get haproxy image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_haproxy_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='haproxy-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container haproxy image\", \"set_fact\": {\"haproxy_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"haproxy_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/haproxy:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_haproxy_image\": \"{{xmllint_pcmk_haproxy_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of haproxy container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_haproxy_image == haproxy_image_latest\", \"fail_msg\": \"haproxy image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"Tear-down non-HA haproxy container\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Remove non-HA haproxy container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"haproxy\"]}}]}, {\"name\": \"Set HAProxy upgrade facts\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"set is_haproxy_bootstrap_node fact\", \"tags\": \"common\", \"set_fact\": \"is_haproxy_bootstrap_node={{haproxy_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\", \"when\": [\"haproxy_short_bootstrap_node_name|default(false)\"]}]}, {\"name\": \"Mount TLS cert if needed\", \"when\": [\"step|int == 1\", \"is_haproxy_bootstrap_node\"], \"block\": [{\"name\": \"Check haproxy public certificate configuration in pacemaker\", \"command\": \"cibadmin --query --xpath \\\"//storage-mapping[@id='haproxy-cert']\\\"\", \"failed_when\": false, \"register\": \"haproxy_cert_mounted\"}, {\"name\": \"Disable the haproxy cluster resource\", \"pacemaker_resource\": {\"resource\": \"haproxy-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\", \"when\": \"haproxy_cert_mounted.rc == 6\"}, {\"name\": \"Set HAProxy public cert volume mount fact\", \"set_fact\": {\"haproxy_public_cert_path\": {\"get_param\": \"DeployedSSLCertificatePath\"}, \"haproxy_public_tls_enabled\": {\"if\": [\"public_tls_enabled\", true, false]}}}, {\"name\": \"Add a bind mount for public certificate in the haproxy bundle\", \"command\": \"pcs resource bundle update haproxy-bundle storage-map add id=haproxy-cert source-dir={{ haproxy_public_cert_path }} target-dir=/var/lib/kolla/config_files/src-tls/{{ haproxy_public_cert_path }} options=ro\", \"when\": \"haproxy_cert_mounted.rc == 6 and haproxy_public_tls_enabled|bool\"}, {\"name\": \"Enable the haproxy cluster resource\", \"pacemaker_resource\": {\"resource\": \"haproxy-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\", \"when\": \"haproxy_cert_mounted.rc == 6\"}]}, {\"name\": \"Haproxy fetch and retag container image for pacemaker\", \"tags\": \"haproxy_syn_block\", \"when\": [\"step|int == 2\"], \"block\": [{\"name\": \"Retag pcmklatest to latest haproxy image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{haproxy_image}}\", \"container_image_latest\": \"{{haproxy_image_latest}}\"}}]}, {\"name\": \"Move virtual IPs to another node before stopping pacemaker\", \"when\": [\"step|int == 1\", \"hostvars[inventory_hostname][\\\"haproxy_node_names\\\"]|default([])|length > 1\"], \"shell\": \"CLUSTER_NODE=$(crm_node -n)\\necho \\\"Retrieving all the VIPs which are hosted on this node\\\"\\nVIPS_TO_MOVE=$(crm_mon --as-xml | xmllint --xpath '//resource[@resource_agent=\\\"ocf:heartbeat:IPaddr2\\\" and @role = \\\"Started\\\" and @managed = \\\"true\\\" and ./node[@name = \\\"'${CLUSTER_NODE}'\\\"]]/@id' - | sed -e 's/id=//g' -e 's/\\\"//g')\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Moving VIP $v on another node\\\"\\n    pcs resource ban $v ${CLUSTER_NODE} --wait=300\\ndone\\necho \\\"Removing the location constraints that were created to move the VIPs\\\"\\nfor v in ${VIPS_TO_MOVE}; do\\n    echo \\\"Removing location ban for VIP $v\\\"\\n    ban_id=$(cibadmin --query | xmllint --xpath 'string(//rsc_location[@rsc=\\\"'${v}'\\\" and @node=\\\"'${CLUSTER_NODE}'\\\" and @score=\\\"-INFINITY\\\"]/@id)' -)\\n    if [ -n \\\"$ban_id\\\" ]; then\\n        pcs constraint remove ${ban_id}\\n    else\\n        echo \\\"Could not retrieve and clear location constraint for VIP $v\\\" 2>&1\\n    fi\\ndone\\n\"}, {\"name\": \"Wait for 10s to settle connections on new VIPs\", \"wait_for\": {\"timeout\": 10}, \"when\": [\"step|int == 1\", \"hostvars[inventory_hostname][\\\"haproxy_node_names\\\"]|default([])|length > 1\"]}, {\"name\": \"Block local INPUT SYN packets on the backends except mysql\", \"tags\": \"haproxy_syn_block\", \"when\": [\"step|int == 1\"], \"shell\": \"# server controller-0.storage.redhat.local 172.17.3.93:8080 check fall 5 inter 2000 rise 2\\n# server controller-0.internalapi.redhat.local fd00:fd00:fd00:2000::176:9292 check fall 5 inter 2000 rise 2\\nset -o pipefail\\nsource /etc/os-release; test  \\\"${VERSION_ID%*}\\\" = \\\"9.0\\\" && exit 0\\ngrep {{ ansible_facts[\\\"hostname\\\"]|lower }} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg  | grep -v \\\":3306 \\\" | \\\\\\nawk '{print $3}' | \\\\\\nwhile read BACKEND; do\\n    IP=${BACKEND%:*}\\n    PORT=${BACKEND#\\\"$IP:\\\"}\\n    if [[ $IP =~ .*:.* ]]\\n      then PROTOCOL=\\\"ip6\\\"\\n      else PROTOCOL=\\\"ip\\\"\\n    fi\\necho \\\"insert rule $PROTOCOL filter INPUT $PROTOCOL daddr $IP tcp dport $PORT tcp flags syn / fin,syn,rst,ack meta time\\\"\\ndone | xargs -i nft {} $(date +%s)-$(date -d'+20 minutes' +%s) counter drop comment \\\"{{ ansible_facts[\\\"hostname\\\"]|lower }}_haproxy_drop\\\"\\n\"}, {\"name\": \"Generate block for other nodes OUTPUT SYN packets on the backends except mysql\", \"tags\": \"haproxy_syn_block\", \"when\": [\"step|int == 1\"], \"shell\": \"set -o pipefail\\nsource /etc/os-release; test  \\\"${VERSION_ID%*}\\\" = \\\"9.0\\\" && exit 0\\ngrep {{ ansible_facts[\\\"hostname\\\"]|lower }} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg  | grep -v \\\":3306 \\\" | \\\\\\nawk '{print $3}' | \\\\\\nwhile read BACKEND; do\\n    IP=${BACKEND%:*}\\n    PORT=${BACKEND#\\\"$IP:\\\"}\\n    if [[ $IP =~ .*:.* ]]\\n      then PROTOCOL=\\\"ip6\\\"\\n      else PROTOCOL=\\\"ip\\\"\\n    fi\\n echo \\\"nft insert rule $PROTOCOL \\\\$TABLE OUTPUT $PROTOCOL daddr $IP tcp dport $PORT tcp flags syn / fin,syn,rst,ack meta time $(date +%s)-$(date -d'+20 minutes' +%s) counter drop comment \\\\\\\"{{ ansible_facts[\\\"hostname\\\"]|lower }}_haproxy_drop\\\\\\\" \\\"\\ndone\\n\", \"register\": \"haproxy_iptables_block\"}, {\"name\": \"Block OUTPUT SYN packets to this node on other haproxy nodes\", \"tags\": \"haproxy_syn_block\", \"delegate_to\": \"{{ item }}\", \"when\": [\"step|int == 1\"], \"shell\": \"set -o pipefail\\ngrep {{ ansible_facts[\\\"hostname\\\"]|lower }} /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg | head -n 1 \\\\\\nawk '{print $3}' | while read BACKEND; do\\n    IP=${BACKEND%:*}\\n    if [[ $IP =~ .*:.* ]]\\n      then PROTOCOL=\\\"ip6\\\"\\n      else PROTOCOL=\\\"ip\\\"\\n    fi\\ndone\\nTABLE=$(nft list tables | grep -q \\\"$PROTOCOL raw\\\" && echo raw || echo filter )\\necho \\\"{{ haproxy_iptables_block.stdout}}\\\" | while read i; do bash -c \\\"$i\\\"; done\\n\", \"loop\": \"{{ groups[\\\"haproxy\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) | difference(ansible_facts[\\\"hostname\\\"]|lower) }}\"}], \"post_update_tasks\": [{\"name\": \"HAProxy bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"HAproxy puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"haproxy\", \"tripleo_ha_wrapper_resource_name\": \"haproxy-bundle\", \"tripleo_ha_wrapper_bundle_name\": \"haproxy-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"haproxy\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::haproxy_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}, {\"name\": \"Cleanup local SYN DROP rules\", \"tags\": \"haproxy_syn_block\", \"when\": \"step|int == 1\", \"shell\": \"nft -a list chain filter INPUT | grep {{ ansible_facts[\\\"hostname\\\"]|lower }} | grep haproxy_drop | \\\\\\nawk -F# '{print \\\"nft delete rule filter INPUT \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"$i\\\"; done\\n\"}, {\"name\": \"Cleanup SYN DROP rules from other haproxy nodes\", \"tags\": \"haproxy_syn_block\", \"when\": \"step|int == 1\", \"delegate_to\": \"{{ item }}\", \"loop\": \"{{ groups[\\\"haproxy\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) | difference(ansible_facts[\\\"hostname\\\"]|lower) }}\", \"shell\": \"nft -a list chain raw OUTPUT | grep {{ ansible_facts[\\\"hostname\\\"]|lower }} | grep haproxy_drop | \\\\\\nawk -F# '{print \\\"nft delete rule raw OUTPUT \\\"$2}' | \\\\\\nwhile read i; do bash -c \\\"$i\\\"; done\\n\"}], \"upgrade_tasks\": [{\"name\": \"Tear-down non-HA haproxy container\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Remove non-HA haproxy container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"haproxy\"]}}]}, {\"name\": \"Prepare switch of haproxy image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get haproxy image id currently used by pacemaker\", \"shell\": \"pcs resource config haproxy-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"haproxy_image_current_res\", \"failed_when\": false}, {\"name\": \"Image facts for haproxy\", \"set_fact\": {\"haproxy_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/haproxy:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"haproxy_image_current\": \"{{haproxy_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current haproxy image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{haproxy_image_current}}\", \"container_image_latest\": \"{{haproxy_image_latest}}\", \"pull_image\": false}, \"when\": [\"haproxy_image_current != ''\", \"haproxy_image_current != haproxy_image_latest\"]}, {\"name\": \"Create haproxy retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/haproxy_needs_retag\", \"state\": \"touch\"}, \"when\": [\"haproxy_image_current != ''\", \"haproxy_image_current != haproxy_image_latest\"]}]}, {\"name\": \"Update haproxy pcs resource bundle for new container image\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Set upgrade haproxy facts\", \"set_fact\": {\"is_haproxy_bootstrap_node\": \"{{haproxy_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}}, {\"name\": \"Check for haproxy retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/haproxy_needs_retag\"}, \"register\": \"haproxy_retag_state_file\"}]}, {\"name\": \"Update haproxy pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_haproxy_bootstrap_node|bool\", \"haproxy_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the haproxy cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"haproxy-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Expose HAProxy stats socket on the host and mount TLS cert if needed\", \"block\": [{\"name\": \"Check haproxy stats socket configuration in pacemaker\", \"command\": \"cibadmin --query --xpath \\\"//storage-mapping[@id='haproxy-var-lib']\\\"\", \"failed_when\": false, \"register\": \"haproxy_stats_exposed\"}, {\"name\": \"Check haproxy public certificate configuration in pacemaker\", \"command\": \"cibadmin --query --xpath \\\"//storage-mapping[@id='haproxy-cert']\\\"\", \"failed_when\": false, \"register\": \"haproxy_cert_mounted\"}, {\"name\": \"Add a bind mount for stats socket in the haproxy bundle\", \"command\": \"pcs resource bundle update haproxy-bundle storage-map add id=haproxy-var-lib source-dir=/var/lib/haproxy target-dir=/var/lib/haproxy options=rw\", \"when\": \"haproxy_stats_exposed.rc == 6\"}, {\"name\": \"Set HAProxy public cert volume mount fact\", \"set_fact\": {\"haproxy_public_cert_path\": {\"get_param\": \"DeployedSSLCertificatePath\"}, \"haproxy_public_tls_enabled\": {\"if\": [\"public_tls_enabled\", true, false]}}}, {\"name\": \"Add a bind mount for public certificate in the haproxy bundle\", \"command\": \"pcs resource bundle update haproxy-bundle storage-map add id=haproxy-cert source-dir={{ haproxy_public_cert_path }} target-dir=/var/lib/kolla/config_files/src-tls/{{ haproxy_public_cert_path }} options=ro\", \"when\": [\"haproxy_cert_mounted.rc == 6\", \"haproxy_public_tls_enabled|bool\"]}]}, {\"name\": \"Update the haproxy bundle to use the new container image name\", \"command\": \"pcs resource bundle update haproxy-bundle container image={{haproxy_image_latest}}\"}, {\"name\": \"Enable the haproxy cluster resource\", \"pacemaker_resource\": {\"resource\": \"haproxy-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Remove haproxy retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/haproxy_needs_retag\", \"state\": \"absent\"}}]}, {\"name\": \"Retag the pacemaker image if containerized\", \"when\": [\"step|int == 3\"], \"block\": [{\"block\": [{\"name\": \"Get haproxy image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_haproxy_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='haproxy-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container haproxy image\", \"set_fact\": {\"haproxy_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"haproxy_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/haproxy:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHAProxyImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_haproxy_image\": \"{{xmllint_pcmk_haproxy_image.stdout}}\"}}]}, {\"block\": [{\"name\": \"Retag pcmklatest to latest haproxy image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{haproxy_image}}\", \"container_image_latest\": \"{{haproxy_image_latest}}\"}}]}, {\"name\": \"Ensure config works for the new config\", \"shell\": \"set -o pipefail\\nawk -i inplace -v INPLACE_SUFFIX=.bak '/  rsprep/ {print \\\"  http-response replace-header Location \\\" $3\\\" \\\"$5; next;}; {print} ' /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg\"}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/haproxy/haproxy-public-tls-inject.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"HAProxy deployment with TLS enabled, with an injected certificate\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"SSLCertificate\": {\"default\": \"\", \"description\": \"The content of the SSL certificate (without Key) in PEM format.\\n\", \"type\": \"string\"}, \"SSLIntermediateCertificate\": {\"default\": \"\", \"description\": \"The content of an SSL intermediate CA certificate in PEM format.\\n\", \"type\": \"string\"}, \"SSLKey\": {\"default\": \"\", \"description\": \"The content of the SSL Key in PEM format.\\n\", \"type\": \"string\", \"hidden\": true}, \"DeployedSSLCertificatePath\": {\"default\": \"/etc/pki/tls/private/overcloud_endpoint.pem\", \"description\": \"The filepath of the certificate as it will be stored in the controller.\\n\", \"type\": \"string\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the HAProxy public TLS injection.\", \"value\": {\"service_name\": \"haproxy_public_tls_inject\", \"config_settings\": {}, \"certificates_specs\": {}, \"metadata_settings\": null, \"host_prep_tasks\": [{\"name\": \"get parameters\", \"set_fact\": {\"cert_path\": {\"get_param\": \"DeployedSSLCertificatePath\"}, \"cert_content\": {\"get_param\": \"SSLCertificate\"}, \"chain_content\": {\"get_param\": \"SSLIntermediateCertificate\"}, \"key_content\": {\"get_param\": \"SSLKey\"}}, \"no_log\": \"{{ hide_sensitive_logs | bool }}\"}, {\"name\": \"manage certificate\", \"when\": [\"cert_content is defined\", \"cert_content != ''\"], \"block\": [{\"name\": \"get DeployedSSLCertificatePath attributes\", \"register\": \"attr_cert_path\", \"stat\": {\"path\": \"{{cert_path}}\"}}, {\"name\": \"set is_haproxy_bootstrap_node fact\", \"set_fact\": \"is_haproxy_bootstrap_node={{haproxy_short_bootstrap_node_name | lower == ansible_facts['hostname'] | lower}}\", \"when\": [\"haproxy_short_bootstrap_node_name|default(false)\"]}, {\"name\": \"get haproxy status\", \"register\": \"haproxy_state\", \"systemd\": {\"name\": \"haproxy\"}}, {\"name\": \"get pacemaker status\", \"register\": \"pacemaker_state\", \"systemd\": {\"name\": \"pacemaker\"}}, {\"name\": \"get docker status\", \"register\": \"docker_state\", \"systemd\": {\"name\": \"docker\"}}, {\"name\": \"get container_id\", \"when\": [\"docker_state.status.ActiveState == 'active' or container_cli == 'podman'\", \"attr_cert_path.stat.exists\", \"attr_cert_path.stat.isdir == False\"], \"command\": \"{{ container_cli }} ps -q -f name='^haproxy(-bundle)?'\", \"register\": \"container_id\"}, {\"name\": \"get pcs resource name for haproxy container\", \"when\": [\"bootstrap_node is defined\", \"is_haproxy_bootstrap_node\", \"pacemaker_state.status.ActiveState == 'active'\", \"attr_cert_path.stat.exists\", \"attr_cert_path.stat.isdir\"], \"shell\": \"pcs status resources | sed -n 's/^.*container.*: \\\\(haproxy.*\\\\) .*/\\\\1/p'\\n\", \"register\": \"pacemaker_resource\"}, {\"name\": \"remove DeployedSSLCertificatePath if is dir\", \"when\": \"attr_cert_path.stat.isdir is defined and attr_cert_path.stat.isdir\", \"file\": {\"path\": \"{{cert_path}}\", \"state\": \"absent\"}}, {\"name\": \"push certificate content\", \"no_log\": \"{{ hide_sensitive_logs | bool }}\", \"copy\": {\"dest\": \"{{cert_path}}\", \"mode\": 288, \"owner\": \"root\", \"content\": \"{{cert_content}}\\n{{chain_content}}\\n{{key_content}}\\n\"}}, {\"name\": \"BM haproxy non-pacemaker context\", \"when\": \"haproxy_state.status.ActiveState == 'active'\", \"block\": [{\"name\": \"set certificate ownership\", \"file\": {\"path\": \"{{cert_path}}\", \"group\": \"haproxy\"}}, {\"name\": \"reload haproxy if enabled\", \"service\": {\"name\": \"haproxy\", \"state\": \"reloaded\"}}]}, {\"name\": \"restart pacemaker resource for haproxy\", \"when\": [\"pacemaker_resource is defined\", \"pacemaker_resource.stdout is defined\", \"pacemaker_resource.stdout != ''\"], \"command\": \"pcs resource restart \\\"{{pacemaker_resource.stdout}}\\\"\"}, {\"name\": \"dedicated part for containers\", \"when\": [\"container_id is defined\", \"container_id.stdout is defined\", \"container_id.stdout != ''\"], \"block\": [{\"name\": \"copy certificate, chgrp, restart haproxy\", \"shell\": \"set -e\\nif {{ container_cli }} ps -f \\\"id={{ item }}\\\" --format \\\"{{ '{{' }}.Names{{ '}}' }}\\\" | grep -q \\\"^haproxy-bundle\\\"; then\\n  tar -c {{ cert_path }} | {{container_cli}} exec -i {{ item }} tar -C / -xv\\nelse\\n  {{ container_cli }} cp {{ cert_path }} {{ item }}:{{ cert_path }}\\nfi\\n{{ container_cli }} exec --user root {{ item }} chgrp haproxy {{ cert_path }}\\n{{ container_cli }} kill --signal=HUP {{ item }}\\n\", \"register\": \"container_kill_result\", \"failed_when\": [\"container_kill_result.rc != 0\", \"(\\\"no such container\\\" not in container_kill_result.stderr)\", \"(\\\"container state improper\\\" not in container_kill_result.stderr)\"], \"with_items\": \"{{ container_id.stdout.split('\\n') }}\"}]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/iscsid/iscsid-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Iscsid service\\n\", \"parameters\": {\"ContainerIscsidImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerIscsidConfigImage\": {\"description\": \"The container image to use for the iscsid config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"LVMFilterEnabled\": {\"default\": false, \"description\": \"Enables configuration of LVM2 with a filter so that devices not in use on the host or explicitly allowed are ignored by LVM2. Can be configured per-role. When disabled, the proposed lvm.conf file will be created regardless and left in /tmp/tripleo_lvmfilter.conf for debugging purposes.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"LVMFilterAllowlist\": {\"default\": [], \"description\": \"A list of block devices which should be allowed in the LVM2 `global_filter`. Supports regular expressions, like `/dev/sd.*` and can be configured per-role. Any block device in use at boot time will be automatically allowed.\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"LVMFilterDenylist\": {\"default\": [\".*\"], \"description\": \"A list of block devices which should be disallowed in the LVM2 `global_filter`. Supports regular expressions, like `/dev/sd.*` and can be configured per-role.\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"IscsidCHAPAlgorithms\": {\"default\": \"SHA3-256,SHA256,SHA1,MD5\", \"description\": \"A comma separated list of algorithms to be used for the CHAP algorithm.\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"tripleo_tripleo_lvmfilter_enabled\": \"LVMFilterEnabled\", \"tripleo_tripleo_lvmfilter_devices_allowlist\": \"LVMFilterAllowlist\", \"tripleo_tripleo_lvmfilter_devices_denylist\": \"LVMFilterDenylist\", \"ContainerIscsidImage\": \"ContainerIscsidImage\", \"ContainerIscsidConfigImage\": \"ContainerIscsidConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"LVMFilterEnabled\": {\"get_param\": \"LVMFilterEnabled\"}, \"LVMFilterAllowlist\": {\"get_param\": \"LVMFilterAllowlist\"}, \"LVMFilterDenylist\": {\"get_param\": \"LVMFilterDenylist\"}, \"ContainerIscsidImage\": {\"get_param\": \"ContainerIscsidImage\"}, \"ContainerIscsidConfigImage\": {\"get_param\": \"ContainerIscsidConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Iscsid role.\", \"value\": {\"service_name\": \"iscsid\", \"config_settings\": {\"tripleo::profile::base::iscsid::chap_algs\": {\"get_param\": \"IscsidCHAPAlgorithms\"}}, \"service_config_settings\": {}, \"deploy_steps_tasks\": [{\"name\": \"Run lvmfilter role\", \"include_role\": {\"name\": \"tripleo_lvmfilter\"}, \"when\": [\"step|int == 1\"]}], \"ansible_group_vars\": {\"get_attr\": [\"RoleParametersValue\", \"value\"]}, \"puppet_config\": {\"config_volume\": \"iscsid\", \"puppet_tags\": \"iscsid_config\", \"step_config\": \"include tripleo::profile::base::iscsid\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerIscsidConfigImage\"]}, \"volumes\": [\"/etc/iscsi:/tmp/iscsi.host:z\"]}, \"kolla_config\": {\"/var/lib/kolla/config_files/iscsid.json\": {\"command\": \"/usr/sbin/iscsid -f\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src-iscsid/\", \"dest\": \"/etc/iscsi/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_3\": {\"iscsid\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerIscsidImage\"]}, \"net\": \"host\", \"privileged\": true, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/iscsid.json:/var/lib/kolla/config_files/config.json:ro\", \"/dev:/dev\", \"/run:/run\", \"/sys:/sys\", \"/lib/modules:/lib/modules:ro\", \"/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro\", \"/etc/target:/etc/target:z\", \"/var/lib/iscsi:/var/lib/iscsi:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create fcontext entry for iscsi\", \"community.general.sefcontext\": {\"target\": \"{{ item.path }}(/.*)?\", \"setype\": \"{{ item.setype }}\", \"state\": \"present\"}, \"with_items\": [{\"path\": \"/etc/iscsi\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/target\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/iscsi\", \"setype\": \"container_file_t\"}]}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\"}, \"with_items\": [{\"path\": \"/etc/iscsi\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/target\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/iscsi\", \"setype\": \"container_file_t\"}]}, {\"name\": \"stat /lib/systemd/system/iscsid.socket\", \"stat\": \"path=/lib/systemd/system/iscsid.socket\", \"register\": \"stat_iscsid_socket\"}, {\"name\": \"Stop and disable iscsid.socket service\", \"service\": \"name=iscsid.socket state=stopped enabled=no\", \"when\": \"stat_iscsid_socket.stat.exists\"}, {\"name\": \"Check if iscsi.service is enabled\", \"command\": \"systemctl is-enabled --quiet iscsi.service\", \"failed_when\": false, \"register\": \"iscsi_service_enabled_result\"}, {\"name\": \"Stop iscsi.service\", \"service\": \"name=iscsi.service state=stopped enabled=no\", \"when\": [\"iscsi_service_enabled_result is changed\", \"iscsi_service_enabled_result.rc == 0\"]}], \"upgrade_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/memcached/memcached-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Memcached services\\n\", \"parameters\": {\"ContainerMemcachedImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerMemcachedConfigImage\": {\"description\": \"The container image to use for the memcached config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MemcachedMaxMemory\": {\"default\": \"50%\", \"description\": \"The maximum amount of memory for memcached to be configured to use when installed. This can be either a percentage ('50%') or a fixed value ('2048').\", \"type\": \"string\"}, \"MemcachedMaxConnections\": {\"default\": 8192, \"description\": \"The maximum number of connections to be accepted by memcached\", \"type\": \"number\"}, \"MonitoringSubscriptionMemcached\": {\"default\": \"overcloud-memcached\", \"type\": \"string\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"MemcachedDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Memcached service.\", \"type\": \"boolean\"}, \"MemcachedIpSubnet\": {\"default\": \"\", \"description\": \"IP address/subnet on the memcached network. If empty (default), MemcachedNetwork will be taken. Useful in the case where an operator wants to open Memcached outside of the internal network. Use this parameter with caution and be aware of opening memcached to external network can be dangerous.\", \"type\": \"string\"}, \"MemcachedPort\": {\"default\": 11211, \"description\": \"Port to have Memcached listening at. When using MemcachedTLS, this has to be set to a different port then the default - see below.\", \"type\": \"number\"}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"MemcachedCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"conditions\": {\"enable_non_tls_port\": {\"and\": [{\"get_param\": \"MemcachedTLS\"}, {\"not\": {\"equals\": [{\"get_param\": \"MemcachedPort\"}, 11211]}}]}, \"memcached_network_set\": {\"not\": {\"equals\": [{\"get_param\": \"MemcachedIpSubnet\"}, \"\"]}}, \"memcached_debug\": {\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"MemcachedDebug\"}]}, \"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}]}, 6]}, \"key_size_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"MemcachedCertificateKeySize\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerMemcachedImage\": \"ContainerMemcachedImage\", \"ContainerMemcachedConfigImage\": \"ContainerMemcachedConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerMemcachedImage\": {\"get_param\": \"ContainerMemcachedImage\"}, \"ContainerMemcachedConfigImage\": {\"get_param\": \"ContainerMemcachedConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Memcached API role.\", \"value\": {\"service_name\": \"memcached\", \"firewall_rules\": {\"if\": [\"memcached_network_set\", {\"121 memcached\": {\"dport\": {\"list_concat\": [[{\"get_param\": \"MemcachedPort\"}], {\"if\": [\"enable_non_tls_port\", [11211]]}]}, \"proto\": \"tcp\", \"source\": {\"get_param\": \"MemcachedIpSubnet\"}}}, {\"map_merge\": {\"repeat\": {\"for_each\": {\"<%net_cidr%>\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}]}}, \"template\": {\"121 memcached <%net_cidr%>\": {\"dport\": {\"list_concat\": [[{\"get_param\": \"MemcachedPort\"}], {\"if\": [\"enable_non_tls_port\", [11211]]}]}, \"proto\": \"tcp\", \"source\": \"<%net_cidr%>\"}}}}}]}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionMemcached\"}, \"config_settings\": {\"map_merge\": [{\"memcached::listen\": {\"list_concat\": [[{\"if\": [\"is_ipv6\", \"::1\", \"127.0.0.1\"]}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}}}}], {\"if\": [\"enable_non_tls_port\", [{\"str_replace\": {\"template\": \"notls:%{hiera('$NETWORK_uri')}:11211\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}}}}, {\"if\": [\"is_ipv6\", \"notls:[::1]:11211\", \"notls:127.0.0.1:11211\"]}]]}]}, \"memcached::listen_ip\": [{\"if\": [\"is_ipv6\", \"::1\", \"127.0.0.1\"]}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}}}}], \"memcached::listen_ip_uri\": [{\"if\": [\"is_ipv6\", \"::1\", \"127.0.0.1\"]}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK_uri')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}}}}], \"memcached::tcp_port\": {\"get_param\": \"MemcachedPort\"}, \"memcached::max_connections\": {\"get_param\": \"MemcachedMaxConnections\"}, \"memcached::max_memory\": {\"get_param\": \"MemcachedMaxMemory\"}, \"memcached::udp_port\": 0, \"memcached::verbosity\": {\"list_join\": [\"\", [\"v\", {\"if\": [\"memcached_debug\", \"v\", \"\"]}]]}, \"memcached::disable_cachedump\": true, \"memcached::logstdout\": true, \"tripleo::profile::base::memcached::enable_internal_memcached_tls\": {\"get_param\": \"MemcachedTLS\"}}, {\"if\": [{\"get_param\": \"MemcachedTLS\"}, {\"tripleo::memcached::service_certificate\": \"/etc/pki/tls/certs/memcached.crt\", \"tripleo::profile::base::memcached::certificate_specs\": {\"service_certificate\": \"/etc/pki/tls/certs/memcached.crt\", \"service_key\": \"/etc/pki/tls/private/memcached.key\"}}]}]}, \"service_config_settings\": {\"collectd\": {\"tripleo.collectd.plugins.memcached\": [\"memcached\"], \"collectd::plugin::memcached::instances\": {\"local\": {\"host\": \"%{hiera('memcached::listen_ip_uri')}\", \"port\": [{\"if\": [\"enable_non_tls_port\", 11211, {\"get_param\": \"MemcachedPort\"}]}]}}}}, \"global_config_settings\": {\"map_merge\": [{\"if\": [\"enable_non_tls_port\", {\"memcached_port\": {\"get_param\": \"MemcachedPort\"}, \"memcached_authtoken_port\": 11211}, {\"memcached_port\": {\"get_param\": \"MemcachedPort\"}, \"memcached_authtoken_port\": {\"get_param\": \"MemcachedPort\"}}]}, {\"if\": [\"is_ipv6\", {\"memcached_ipv6\": true}]}]}, \"puppet_config\": {\"config_volume\": \"memcached\", \"puppet_tags\": \"file\", \"step_config\": \"include tripleo::profile::base::memcached\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMemcachedConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/memcached.json\": {\"command\": \"bash -c $* -- eval source /etc/sysconfig/memcached; exec /usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS >> /var/log/memcached/memcached.log 2>&1\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/memcached\", \"owner\": \"memcached:memcached\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/memcached.crt\", \"owner\": \"memcached:memcached\", \"optional\": true}, {\"path\": \"/etc/pki/tls/private/memcached.key\", \"owner\": \"memcached:memcached\", \"optional\": true}]}}, \"docker_config\": {\"step_1\": {\"memcached\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerMemcachedImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/memcached.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/memcached:/var/lib/kolla/config_files/src:rw,z\", \"/var/log/containers/memcached:/var/log/memcached:rw\"], {\"if\": [{\"get_param\": \"MemcachedTLS\"}, [\"/etc/pki/tls/certs/memcached.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/memcached.crt:ro\", \"/etc/pki/tls/private/memcached.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/memcached.key:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"if\": [{\"get_param\": \"MemcachedTLS\"}, [{\"service\": \"memcached\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}, \"type\": \"node\"}]]}, \"deploy_steps_tasks\": {\"if\": [{\"get_param\": \"MemcachedTLS\"}, [{\"name\": \"Certificate generation\", \"when\": \"step|int == 1\", \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"memcached\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"memcached/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MemcachedNetwork\"]}}}}, \"run_after\": \"container_name=$({{container_cli}} ps --format=\\\\{\\\\{.Names\\\\}\\\\} | grep memcached)\\nservice_crt=\\\"/etc/pki/tls/certs/memcached.crt\\\"\\nservice_key=\\\"/etc/pki/tls/private/memcached.key\\\"\\n# Copy the new cert from the mount-point to the real path\\n{{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_crt\\\" \\\"$service_crt\\\"\\n# Copy the new key from the mount-point to the real path\\n{{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_key\\\" \\\"$service_key\\\"\\n# Set appropriate permissions\\n{{container_cli}} exec -u root \\\"$container_name\\\" chown memcached:memcached \\\"$service_crt\\\"\\n{{container_cli}} exec -u root \\\"$container_name\\\" chown memcached:memcached \\\"$service_key\\\"\\n# Send refresh_certs command to memcached to read the new certificate\\nmemcached_ip=\\\"$(hiera -c /etc/puppet/hiera.yaml memcached::listen_ip.0 127.0.0.1)\\\"\\nmemcached_port=\\\"$(hiera -c /etc/puppet/hiera.yaml memcached::tcp_port 11211)\\\"\\necho refresh_certs | openssl s_client -connect $memcached_ip:$memcached_port\\n\", \"key_size\": {\"if\": [\"key_size_override_set\", {\"get_param\": \"MemcachedCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}]]}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/memcached\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop memcached container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"memcached\"], \"tripleo_delegate_to\": \"{{ groups['memcached'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/tuned/tuned-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configure tuned\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"TunedCustomProfile\": {\"default\": \"\", \"description\": \"The definition of a new tuned profile in INI format which will be named after the TunedProfileName and applied to the host. E.g. if TunedProfileName is 'my_profile', it creates the file '/etc/tuned/my_profile/tuned.conf' on host whose content is the value of TunedCustomProfile, e.g. \\\"[main]\\\\n include=throughput-performance\\\\n[sysctl]\\\\nvm.dirty_ratio=10\\\"\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"TunedProfileName\": {\"default\": \"throughput-performance\", \"description\": \"Tuned Profile to apply to the host\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"tuned_profile\": \"TunedProfileName\", \"tuned_custom_profile\": \"TunedCustomProfile\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"TunedProfileName\": {\"get_param\": \"TunedProfileName\"}, \"TunedCustomProfile\": {\"get_param\": \"TunedCustomProfile\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for tuned\", \"value\": {\"service_name\": \"tuned\", \"host_prep_tasks\": [{\"include_role\": {\"name\": \"tuned\"}}], \"ansible_group_vars\": {\"tuned_profile\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"tuned_profile\"]}, \"tuned_custom_profile\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"tuned_custom_profile\"]}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/sshd/sshd-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configure sshd_config\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"BannerText\": {\"default\": \"\", \"description\": \"Configures Banner text in sshd_config\", \"type\": \"string\"}, \"MessageOfTheDay\": {\"default\": \"\", \"description\": \"Configures /etc/motd text\", \"type\": \"string\"}, \"SshServerOptions\": {\"default\": {}, \"description\": \"Mapping of sshd_config values\", \"type\": \"json\"}, \"PasswordAuthentication\": {\"default\": \"no\", \"description\": \"Whether or not disable password authentication\", \"type\": \"string\"}, \"SshFirewallAllowAll\": {\"default\": false, \"description\": \"Set this to true to open up ssh access from all sources.\", \"type\": \"boolean\"}, \"SshServerOptionsOverrides\": {\"default\": {}, \"description\": \"Mapping of sshd_config values to override definitions in SshServerOptions\", \"type\": \"json\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"SshServerOptionsOverrides\"]}], \"conditions\": {\"ssh_firewall_allow_all\": {\"equals\": [{\"get_param\": \"SshFirewallAllowAll\"}, true]}, \"ssh_banner_text_set\": {\"not\": {\"equals\": [{\"get_param\": \"BannerText\"}, \"\"]}}, \"ssh_motd_text_set\": {\"not\": {\"equals\": [{\"get_param\": \"MessageOfTheDay\"}, \"\"]}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the ssh\", \"value\": {\"service_name\": \"sshd\", \"firewall_rules\": {\"003 accept ssh from all\": {\"proto\": \"tcp\", \"dport\": 22, \"extras\": {\"ensure\": {\"if\": [\"ssh_firewall_allow_all\", \"present\", \"absent\"]}}}}, \"host_prep_tasks\": [{\"include_role\": {\"name\": \"tripleo_sshd\"}, \"vars\": {\"tripleo_sshd_server_options\": {\"map_merge\": [{\"get_param\": \"SshServerOptions\"}, {\"get_param\": \"SshServerOptionsOverrides\"}]}, \"tripleo_sshd_password_authentication\": {\"get_param\": \"PasswordAuthentication\"}, \"tripleo_sshd_banner_enabled\": {\"if\": [\"ssh_banner_text_set\", true, false]}, \"tripleo_sshd_banner_text\": {\"get_param\": \"BannerText\"}, \"tripleo_sshd_motd_enabled\": {\"if\": [\"ssh_motd_text_set\", true, false]}, \"tripleo_sshd_message_of_the_day\": {\"get_param\": \"MessageOfTheDay\"}}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Nova base service. Shared for all Nova services.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"NeutronPassword\": {\"description\": \"The password for the neutron service and db account, used by neutron agents.\", \"type\": \"string\", \"hidden\": true}, \"PlacementPassword\": {\"description\": \"The password for the Placement service and db account\", \"type\": \"string\", \"hidden\": true}, \"PlacementAPIInterface\": {\"type\": \"string\", \"description\": \"Endpoint interface to be used for the placement API.\\n\", \"default\": \"internal\"}, \"NovaOVSBridge\": {\"default\": \"br-int\", \"description\": \"Name of integration bridge used by Open vSwitch\", \"type\": \"string\"}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"NovaDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Nova services.\", \"type\": \"boolean\"}, \"EnableCache\": {\"description\": \"Enable caching with memcached\", \"type\": \"boolean\", \"default\": true}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"EnableConfigPurge\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Remove configuration that is not generated by TripleO. Used to avoid configuration remnants after upgrades.\\n\"}, \"UpgradeLevelNovaCompute\": {\"type\": \"string\", \"description\": \"Nova Compute upgrade level\", \"default\": \"\"}, \"NovaOVSDBConnection\": {\"type\": \"string\", \"description\": \"OVS DB connection string to used by Nova\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaSyncPowerStateInterval\": {\"type\": \"number\", \"description\": \"Interval to sync power states between the database and the hypervisor. Set to -1 to disable. Setting this to 0 will run at the default rate(60) defined in oslo.service.\", \"default\": 600}, \"RpcUseSSL\": {\"default\": false, \"description\": \"Messaging client subscriber parameter to specify an SSL connection to the messaging host.\\n\", \"type\": \"string\"}, \"NovaAdditionalCell\": {\"default\": false, \"description\": \"Whether this is an cell additional to the default cell.\", \"type\": \"boolean\"}, \"NovaCrossAZAttach\": {\"default\": true, \"description\": \"Whether instances can attach cinder volumes from a different availability zone.\", \"type\": \"boolean\"}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}}, \"conditions\": {\"compute_upgrade_level_set\": {\"not\": {\"equals\": [{\"get_param\": \"UpgradeLevelNovaCompute\"}, \"\"]}}, \"tls_cache_enabled\": {\"and\": [{\"get_param\": \"EnableCache\"}, {\"get_param\": \"MemcachedTLS\"}]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"nova::ovsdb_connection\": \"NovaOVSDBConnection\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NovaOVSDBConnection\": {\"get_param\": \"NovaOVSDBConnection\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova base service.\", \"value\": {\"service_name\": \"nova_base\", \"config_settings\": {\"map_merge\": [{\"nova::my_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}}}, \"nova::rabbit_use_ssl\": {\"get_param\": \"RpcUseSSL\"}, \"nova::keystone::service_user::send_service_user_token\": true, \"nova::keystone::service_user::project_name\": \"service\", \"nova::keystone::service_user::password\": {\"get_param\": \"NovaPassword\"}, \"nova::keystone::service_user::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"nova::keystone::service_user::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::placement::project_name\": \"service\", \"nova::placement::password\": {\"get_param\": \"PlacementPassword\"}, \"nova::placement::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"nova::placement::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::placement::valid_interfaces\": {\"get_param\": \"PlacementAPIInterface\"}, \"nova::os_region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::logging::debug\": {\"if\": [{\"get_param\": \"NovaDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"nova::purge_config\": {\"get_param\": \"EnableConfigPurge\"}, \"nova::network::neutron::project_name\": \"service\", \"nova::network::neutron::username\": \"neutron\", \"nova::network::neutron::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::dhcp_domain\": \"\", \"nova::network::neutron::password\": {\"get_param\": \"NeutronPassword\"}, \"nova::network::neutron::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"nova::network::neutron::valid_interfaces\": \"internal\", \"nova::glance::valid_interfaces\": \"internal\", \"nova::rabbit_heartbeat_timeout_threshold\": 60, \"nova::cinder_catalog_info\": \"volumev3:cinderv3:internalURL\", \"nova::host\": \"%{hiera('fqdn_canonical')}\", \"nova::notify_on_state_change\": \"vm_and_task_state\", \"nova::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"nova::notification_format\": \"unversioned\", \"nova::network::neutron::auth_type\": \"v3password\", \"nova::db::database_db_max_retries\": -1, \"nova::db::database_max_retries\": -1, \"nova::network::neutron::ovs_bridge\": {\"get_param\": \"NovaOVSBridge\"}, \"nova::compute::sync_power_state_interval\": {\"get_param\": \"NovaSyncPowerStateInterval\"}, \"nova_is_additional_cell\": {\"get_param\": \"NovaAdditionalCell\"}, \"nova::cross_az_attach\": {\"get_param\": \"NovaCrossAZAttach\"}, \"nova::cache::enabled\": {\"get_param\": \"EnableCache\"}, \"nova::cache::tls_enabled\": {\"get_param\": \"MemcachedTLS\"}, \"nova::cache::backend\": {\"if\": [\"tls_cache_enabled\", \"dogpile.cache.pymemcache\", \"dogpile.cache.memcached\"]}, \"nova::rabbit_heartbeat_in_pthread\": false, \"nova::upgrade_level_compute\": {\"if\": [\"compute_upgrade_level_set\", {\"get_param\": \"UpgradeLevelNovaCompute\"}]}}, {\"get_attr\": [\"RoleParametersValue\", \"value\"]}]}, \"service_config_settings\": {\"rabbitmq\": {\"nova::rabbit_use_ssl\": {\"get_param\": \"RpcUseSSL\"}}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-apidb-client-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Nova database client service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova base service.\", \"value\": {\"config_settings\": {\"nova::api_database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"nova_api\", \"password\": {\"get_param\": \"NovaPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/nova_api\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"nova_api\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}}, \"service_config_settings\": {\"mysql\": {\"nova::db::mysql_api::password\": {\"get_param\": \"NovaPassword\"}, \"nova::db::mysql_api::user\": \"nova_api\", \"nova::db::mysql_api::host\": \"%\", \"nova::db::mysql_api::dbname\": \"nova_api\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-db-client-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Nova database client service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova base service.\", \"value\": {\"config_settings\": {\"nova::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlCellInternal\", \"protocol\"]}, \"username\": \"nova\", \"password\": {\"get_param\": \"NovaPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlCellInternal\", \"host\"]}, \"path\": \"/nova\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"nova\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}}, \"service_config_settings\": {\"mysql\": {\"nova::db::mysql::password\": {\"get_param\": \"NovaPassword\"}, \"nova::db::mysql::user\": \"nova\", \"nova::db::mysql::host\": \"%\", \"nova::db::mysql::dbname\": \"nova\"}}}}}}", "file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_wait_for_api_service.py": "#!/usr/bin/python3\n#\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\nimport argparse\nimport logging\nimport os\nimport six\nimport sys\nimport time\n\n\nfrom keystoneauth1 import loading\nfrom keystoneauth1 import session\n\nfrom novaclient import client\nfrom novaclient.exceptions import ClientException\n\n# In python3 SafeConfigParser was renamed to ConfigParser and the default\n# for duplicate options default to true. In case of nova it is valid to\n# have duplicate option lines, e.g. passthrough_whitelist which leads to\n# issues reading the nova.conf\n# https://bugs.launchpad.net/tripleo/+bug/1827775\nif six.PY3:\n    from six.moves.configparser import ConfigParser\n    config = ConfigParser(strict=False)\nelse:\n    from six.moves.configparser import SafeConfigParser\n    config = SafeConfigParser()\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('nova_wait_for_api_service')\n\niterations = 60\ntimeout = 10\nnova_cfg = '/etc/nova/nova.conf'\n\nif __name__ == '__main__':\n    parser = argparse.ArgumentParser(usage='%(prog)s [options]')\n    parser.add_argument('-k', '--insecure',\n                        action=\"store_false\",\n                        dest='insecure',\n                        default=True,\n                        help='Allow insecure connection when using SSL')\n\n    args = parser.parse_args()\n    LOG.debug('Running with parameter insecure = %s',\n              args.insecure)\n\n    if os.path.isfile(nova_cfg):\n        try:\n            config.read(nova_cfg)\n        except Exception:\n            LOG.exception('Error while reading nova.conf:')\n    else:\n        LOG.error('Nova configuration file %s does not exist', nova_cfg)\n        sys.exit(1)\n\n    loader = loading.get_plugin_loader('password')\n    auth = loader.load_from_options(\n        auth_url=config.get('neutron',\n                            'auth_url'),\n        username=config.get('neutron',\n                            'username'),\n        password=config.get('neutron',\n                            'password'),\n        project_name=config.get('neutron',\n                                'project_name'),\n        project_domain_name=config.get('neutron',\n                                       'project_domain_name'),\n        user_domain_name=config.get('neutron',\n                                    'user_domain_name'))\n    sess = session.Session(auth=auth, verify=args.insecure)\n\n    # Wait until this host is listed in the service list\n    for i in range(iterations):\n        try:\n            nova = client.Client('2.11', session=sess, endpoint_type='internal')\n            nova.versions.list()\n            LOG.info('Nova-api service active')\n            sys.exit(0)\n        except ClientException:\n            LOG.info('Waiting for nova-api service')\n        except Exception:\n            LOG.exception(\n                'Error while waiting for nova-api service')\n        time.sleep(timeout)\nsys.exit(1)\n\n# vim: set et ts=4 sw=4 :\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_api_ensure_default_cells.py": "#!/usr/bin/python3\n#\n# Copyright 2022 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n\nfrom configparser import ConfigParser\nimport logging\nimport os\nimport subprocess\nimport sys\nfrom urllib import parse as urlparse\n\nconfig = ConfigParser(strict=False)\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('nova_api_ensure_default_cells')\n\nNOVA_CFG = '/etc/nova/nova.conf'\nCELL0_ID = '00000000-0000-0000-0000-000000000000'\nDEFAULT_CELL_NAME = 'default'\n\n\ndef template_netloc_credentials(netloc, index=None):\n    if '@' in netloc:\n        userpass, hostport = netloc.split('@', 1)\n        has_pass = ':' in userpass\n        if index is None:\n            cred_template = '{username}'\n            if has_pass:\n                cred_template += ':{password}'\n        else:\n            cred_template = '{{username{index}}}'.format(index=index)\n            if has_pass:\n                cred_template += ':{{password{index}}}'.format(index=index)\n        return '@'.join((cred_template, hostport))\n    else:\n        return netloc\n\n\ndef template_url(url):\n    parsed = urlparse.urlparse(url)\n    if ',' in parsed.netloc:\n        orig_netlocs = parsed.netloc.split(',')\n        templ_netlocs = []\n        index = 0\n        for netloc in orig_netlocs:\n            index += 1\n            templ_netlocs.append(template_netloc_credentials(netloc, index))\n        new_netloc = ','.join(templ_netlocs)\n    else:\n        new_netloc = template_netloc_credentials(parsed.netloc)\n    return parsed._replace(netloc=new_netloc).geturl()\n\n\ndef parse_list_cells(list_cells_output):\n    list_cells_lines = list_cells_output.split('\\n')\n    if len(list_cells_lines) < 5:\n        raise ValueError('Invalid nova-manage cell_v2 list_cells output')\n\n    data_rows = list_cells_lines[3:-2]\n    by_name = {}\n    by_uuid = {}\n\n    for row in data_rows:\n        parts = row.split('|')\n        entry = {\n            'name': parts[1].strip(),\n            'uuid': parts[2].strip(),\n            'transport_url': parts[3].strip(),\n            'database_connection': parts[4].strip(),\n        }\n        by_name[entry['name']] = entry\n        by_uuid[entry['uuid']] = entry\n\n    return by_name, by_uuid\n\n\ndef create_or_update_default_cells(cell0_db, default_db, default_transport_url):\n    list_cells_cmd = ['/usr/bin/nova-manage', 'cell_v2', 'list_cells', '--verbose']\n    list_cells_output = subprocess.check_output(list_cells_cmd, encoding='utf-8')\n    cells_by_name, cells_by_uuid = parse_list_cells(list_cells_output)\n\n    if CELL0_ID in cells_by_uuid:\n        LOG.info('Setting cell0 database connection to \\'{}\\''.format(cell0_db))\n        cmd = [\n            '/usr/bin/nova-manage', 'cell_v2', 'update_cell',\n            '--cell_uuid', CELL0_ID,\n            '--database_connection', cell0_db,\n            '--transport-url', 'none:///'\n        ]\n    else:\n        LOG.info('Creating cell0 with database connection \\'{}\\''.format(cell0_db))\n        cmd = [\n            '/usr/bin/nova-manage', 'cell_v2', 'map_cell0',\n             '--database_connection', cell0_db\n        ]\n    subprocess.check_call(cmd)\n\n    if DEFAULT_CELL_NAME in cells_by_name:\n        LOG.info('Setting default cell database connection to \\'{}\\' and transport url to \\'{}\\''.format(\n            default_db, default_transport_url))\n        cmd = [\n            '/usr/bin/nova-manage', 'cell_v2', 'update_cell',\n            '--cell_uuid', cells_by_name[DEFAULT_CELL_NAME]['uuid'],\n            '--database_connection', default_db,\n            '--transport-url', default_transport_url\n        ]\n    else:\n        LOG.info('Creating default cell with database connection \\'{}\\' and transport url \\'{}\\''.format(\n            default_db, default_transport_url))\n        cmd = [\n            '/usr/bin/nova-manage', 'cell_v2', 'create_cell',\n            '--name', DEFAULT_CELL_NAME,\n             '--database_connection', default_db,\n            '--transport-url', default_transport_url\n        ]\n    subprocess.check_call(cmd)\n\n\ndef replace_db_name(db_url, db_name):\n    return urlparse.urlparse(db_url)._replace(path=db_name).geturl()\n\n\nif __name__ == '__main__':\n    if os.path.isfile(NOVA_CFG):\n        try:\n            config.read(NOVA_CFG)\n        except Exception:\n            LOG.exception('Error while reading nova.conf:')\n            sys.exit(1)\n    else:\n        LOG.error('Nova configuration file %s does not exist', NOVA_CFG)\n        sys.exit(1)\n\n    default_database_connection = config.get('database', 'connection')\n    cell0_database_connection = replace_db_name(default_database_connection, 'nova_cell0')\n    default_transport_url = config.get('DEFAULT', 'transport_url')\n\n    create_or_update_default_cells(\n        template_url(cell0_database_connection),\n        template_url(default_database_connection),\n        template_url(default_transport_url)\n    )\n", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova API service\\n\", \"parameters\": {\"ContainerNovaApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaConfigImage\": {\"description\": \"The container image to use for the nova config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.nova.api\", \"file\": \"/var/log/containers/nova/nova-api.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"MysqlIPv6\": {\"default\": false, \"description\": \"Enable IPv6 in MySQL\", \"type\": \"boolean\"}, \"NovaWorkers\": {\"default\": 0, \"description\": \"Number of workers for Nova services.\", \"type\": \"number\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"InstanceNameTemplate\": {\"default\": \"instance-%08x\", \"description\": \"Template string to be used to generate instance names\", \"type\": \"string\"}, \"NovaEnableDBPurge\": {\"default\": true, \"description\": \"Whether to create cron job for purging soft deleted rows in Nova database.\\n\", \"type\": \"boolean\"}, \"NovaEnableDBArchive\": {\"default\": true, \"description\": \"Whether to create cron job for archiving soft deleted rows in Nova database.\\n\", \"type\": \"boolean\"}, \"MonitoringSubscriptionNovaApi\": {\"default\": \"overcloud-nova-api\", \"type\": \"string\"}, \"NovaDefaultFloatingPool\": {\"default\": \"public\", \"description\": \"Default pool for floating IP addresses\", \"type\": \"string\"}, \"NovaApiPolicies\": {\"description\": \"A hash of policies to configure for Nova API.\\ne.g. { nova-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"NovaAllowResizeToSameHost\": {\"default\": false, \"description\": \"Allow destination machine to match source for resize.\", \"type\": \"boolean\"}, \"NovaApiMaxLimit\": {\"default\": 1000, \"description\": \"Max number of objects returned per API query\", \"type\": \"number\"}, \"NovaCronPurgeShadowTablesMinute\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Minute\\n\", \"default\": \"0\"}, \"NovaCronPurgeShadowTablesHour\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Hour\\n\", \"default\": \"5\"}, \"NovaCronPurgeShadowTablesMonthday\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Month Day\\n\", \"default\": \"*\"}, \"NovaCronPurgeShadowTablesMonth\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Month\\n\", \"default\": \"*\"}, \"NovaCronPurgeShadowTablesWeekday\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Week Day\\n\", \"default\": \"*\"}, \"NovaCronPurgeShadowTablesUser\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - User\\n\", \"default\": \"nova\"}, \"NovaCronPurgeShadowTablesDestination\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Log destination\\n\", \"default\": \"/var/log/nova/nova-rowspurge.log\"}, \"NovaCronPurgeShadowTablesMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to purge shadow tables - Max Delay\\n\", \"default\": \"3600\"}, \"NovaCronPurgeShadowTablesAge\": {\"type\": \"number\", \"description\": \"Cron to purge shadow tables - Age This will define the retention policy when purging the shadow tables in days. 0 means, purge data older than today in shadow tables.\\n\", \"default\": 14}, \"NovaCronPurgeShadowTablesVerbose\": {\"type\": \"boolean\", \"description\": \"Cron to purge shadow tables - Verbose\\n\", \"default\": false}, \"NovaCronPurgeShadowTablesAllCells\": {\"type\": \"boolean\", \"description\": \"Cron to purge shadow tables - All cells\\n\", \"default\": true}, \"NovaCronArchiveDeleteRowsMinute\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Minute\\n\", \"default\": \"1\"}, \"NovaCronArchiveDeleteRowsHour\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Hour\\n\", \"default\": \"0\"}, \"NovaCronArchiveDeleteRowsMonthday\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Month Day\\n\", \"default\": \"*\"}, \"NovaCronArchiveDeleteRowsMonth\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Month\\n\", \"default\": \"*\"}, \"NovaCronArchiveDeleteRowsWeekday\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Week Day\\n\", \"default\": \"*\"}, \"NovaCronArchiveDeleteRowsMaxRows\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Max Rows\\n\", \"default\": \"1000\"}, \"NovaCronArchiveDeleteRowsUser\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - User\\n\", \"default\": \"nova\"}, \"NovaCronArchiveDeleteRowsDestination\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Log destination\\n\", \"default\": \"/var/log/nova/nova-rowsflush.log\"}, \"NovaCronArchiveDeleteRowsMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to move deleted instances to another table - Max Delay\\n\", \"default\": \"3600\"}, \"NovaCronArchiveDeleteRowsUntilComplete\": {\"type\": \"boolean\", \"description\": \"Cron to move deleted instances to another table - Until complete\\n\", \"default\": true}, \"NovaCronArchiveDeleteRowsPurge\": {\"type\": \"boolean\", \"description\": \"Purge shadow tables immediately after scheduled archiving\\n\", \"default\": false}, \"NovaCronArchiveDeleteAllCells\": {\"type\": \"boolean\", \"description\": \"Archive deleted instances from all cells\\n\", \"default\": true}, \"NovaCronArchiveDeleteRowsAge\": {\"type\": \"number\", \"description\": \"Cron to archive deleted instances - Age This will define the retention policy when archiving the deleted instances entries in days. 0 means, purge data older than today in shadow tables.\\n\", \"default\": 90}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"NovaShowHostStatus\": {\"type\": \"string\", \"description\": \"Allow overriding API policies to access the compute host status in the\\nrequested Nova server details. The default value 'hidden' allows only admins to\\naccess it. Setting it to 'all' ('unknown-only') without additional fine-grained\\ntuning of NovaApiHostStatusPolicy shows the full (limited) host_status\\nto the system/project readers.\\n\", \"default\": \"hidden\", \"constraints\": [{\"allowed_values\": [\"all\", \"unknown-only\", \"hidden\"]}]}, \"NovaApiHostStatusPolicy\": {\"description\": \"A custom API policy for os_compute_api:servers:show:host_status and\\nos_compute_api:servers:show:host_status:unknown-only.\\nThese rules, or roles, replace the admins-only policies based on the given\\nNovaShowHostStatus: 'unknown-only' shows the limited host status UNKNOWN\\nwhenever a heartbeat was not received within the configured threshold, and\\n'all' also reveals UP, DOWN, or MAINTENANCE statuses in the Nova server\\ndetails. NovaShowHostStatus 'hidden' puts it back being visible only for admins.\\nAdditional policies specified using NovaApiPolicies get merged with this\\npolicy.\\n\", \"default\": \"role:reader\", \"type\": \"string\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"MysqlIPv6\"]}], \"conditions\": {\"mysql_ipv6_use_ip_address\": {\"and\": [{\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}]}, 6]}, {\"not\": {\"get_param\": \"EnableInternalTLS\"}}]}, \"nova_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"NovaWorkers\"}, 0]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"NovaApiLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaApi\"}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaApiDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-apidb-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-db-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaApiImage\": \"ContainerNovaApiImage\", \"ContainerNovaConfigImage\": \"ContainerNovaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaApiImage\": {\"get_param\": \"ContainerNovaApiImage\"}, \"ContainerNovaConfigImage\": {\"get_param\": \"ContainerNovaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova API role.\", \"value\": {\"service_name\": \"nova_api\", \"firewall_rules\": {\"113 nova_api\": {\"dport\": [8774]}}, \"firewall_frontend_rules\": {\"100 nova_osapi_haproxy_frontend\": {\"dport\": [8774]}}, \"firewall_ssl_frontend_rules\": {\"100 nova_osapi_haproxy_frontend_ssl\": {\"dport\": [13774]}}, \"keystone_resources\": {\"nova\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"NovaInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"NovaAdmin\", \"uri\"]}}, \"users\": {\"nova\": {\"roles\": [\"admin\", \"service\"], \"password\": {\"get_param\": \"NovaPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"compute\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaApiLogging\", \"config_settings\"]}, {\"apache::default_vhost\": false, \"nova::keystone::authtoken::project_name\": \"service\", \"nova::keystone::authtoken::user_domain_name\": \"Default\", \"nova::keystone::authtoken::project_domain_name\": \"Default\", \"nova::keystone::authtoken::password\": {\"get_param\": \"NovaPassword\"}, \"nova::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"nova::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"nova::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::keystone::authtoken::interface\": \"internal\", \"nova::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"nova::api::max_limit\": {\"get_param\": \"NovaApiMaxLimit\"}, \"nova::api::enabled\": true, \"nova::network::neutron::default_floating_pool\": {\"get_param\": \"NovaDefaultFloatingPool\"}, \"nova::api::enable_proxy_headers_parsing\": true, \"nova::api::api_bind_address\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}}}, \"nova::api::service_name\": \"httpd\", \"nova::wsgi::apache_api::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"nova::wsgi::apache_api::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}}}, \"nova::wsgi::apache_api::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}}}, \"nova::api::instance_name_template\": {\"get_param\": \"InstanceNameTemplate\"}, \"nova::policy::policies\": {\"map_merge\": [{\"get_param\": \"NovaApiPolicies\"}, {\"if\": [{\"equals\": [{\"get_param\": \"NovaShowHostStatus\"}, \"all\"]}, {\"nova-os_compute_api_servers_show_host_status\": {\"key\": \"os_compute_api:servers:show:host_status\", \"value\": {\"get_param\": \"NovaApiHostStatusPolicy\"}}}, {}]}, {\"if\": [{\"equals\": [{\"get_param\": \"NovaShowHostStatus\"}, \"unknown-only\"]}, {\"nova-os_compute_api_servers_show_host_status_unknown-only\": {\"key\": \"os_compute_api:servers:show:host_status:unknown-only\", \"value\": {\"get_param\": \"NovaApiHostStatusPolicy\"}}}, {}]}]}, \"nova::api::allow_resize_to_same_host\": {\"get_param\": \"NovaAllowResizeToSameHost\"}, \"nova_enable_db_purge\": {\"get_param\": \"NovaEnableDBPurge\"}, \"nova::cron::purge_shadow_tables::minute\": {\"get_param\": \"NovaCronPurgeShadowTablesMinute\"}, \"nova::cron::purge_shadow_tables::hour\": {\"get_param\": \"NovaCronPurgeShadowTablesHour\"}, \"nova::cron::purge_shadow_tables::monthday\": {\"get_param\": \"NovaCronPurgeShadowTablesMonthday\"}, \"nova::cron::purge_shadow_tables::month\": {\"get_param\": \"NovaCronPurgeShadowTablesMonth\"}, \"nova::cron::purge_shadow_tables::weekday\": {\"get_param\": \"NovaCronPurgeShadowTablesWeekday\"}, \"nova::cron::purge_shadow_tables::user\": {\"get_param\": \"NovaCronPurgeShadowTablesUser\"}, \"nova::cron::purge_shadow_tables::destination\": {\"get_param\": \"NovaCronPurgeShadowTablesDestination\"}, \"nova::cron::purge_shadow_tables::maxdelay\": {\"get_param\": \"NovaCronPurgeShadowTablesMaxDelay\"}, \"nova::cron::purge_shadow_tables::age\": {\"get_param\": \"NovaCronPurgeShadowTablesAge\"}, \"nova::cron::purge_shadow_tables::verbose\": {\"get_param\": \"NovaCronPurgeShadowTablesVerbose\"}, \"nova::cron::purge_shadow_tables::all_cells\": {\"get_param\": \"NovaCronPurgeShadowTablesAllCells\"}, \"nova_enable_db_archive\": {\"get_param\": \"NovaEnableDBArchive\"}, \"nova::cron::archive_deleted_rows::minute\": {\"get_param\": \"NovaCronArchiveDeleteRowsMinute\"}, \"nova::cron::archive_deleted_rows::hour\": {\"get_param\": \"NovaCronArchiveDeleteRowsHour\"}, \"nova::cron::archive_deleted_rows::monthday\": {\"get_param\": \"NovaCronArchiveDeleteRowsMonthday\"}, \"nova::cron::archive_deleted_rows::month\": {\"get_param\": \"NovaCronArchiveDeleteRowsMonth\"}, \"nova::cron::archive_deleted_rows::weekday\": {\"get_param\": \"NovaCronArchiveDeleteRowsWeekday\"}, \"nova::cron::archive_deleted_rows::max_rows\": {\"get_param\": \"NovaCronArchiveDeleteRowsMaxRows\"}, \"nova::cron::archive_deleted_rows::user\": {\"get_param\": \"NovaCronArchiveDeleteRowsUser\"}, \"nova::cron::archive_deleted_rows::destination\": {\"get_param\": \"NovaCronArchiveDeleteRowsDestination\"}, \"nova::cron::archive_deleted_rows::maxdelay\": {\"get_param\": \"NovaCronArchiveDeleteRowsMaxDelay\"}, \"nova::cron::archive_deleted_rows::until_complete\": {\"get_param\": \"NovaCronArchiveDeleteRowsUntilComplete\"}, \"nova::cron::archive_deleted_rows::purge\": {\"get_param\": \"NovaCronArchiveDeleteRowsPurge\"}, \"nova::cron::archive_deleted_rows::all_cells\": {\"get_param\": \"NovaCronArchiveDeleteAllCells\"}, \"nova::cron::archive_deleted_rows::age\": {\"get_param\": \"NovaCronArchiveDeleteRowsAge\"}, \"nova::policy::enforce_new_defaults\": {\"get_param\": \"EnforceSecureRbac\"}, \"nova::policy::enforce_scope\": {\"get_param\": \"EnforceSecureRbac\"}}, {\"if\": [\"nova_workers_set\", {\"nova::api::osapi_compute_workers\": {\"get_param\": \"NovaWorkers\"}, \"nova::wsgi::apache_api::workers\": {\"get_param\": \"NovaWorkers\"}}]}]}, \"service_config_settings\": {\"rabbitmq\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"service_config_settings\"], \"rabbitmq\": null}, \"mysql\": {\"map_merge\": [{\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}]}, \"rsyslog\": {\"tripleo_logging_sources_nova_api\": [{\"get_param\": \"NovaApiLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"nova\", \"puppet_tags\": \"nova_config,nova_api_paste_ini\", \"step_config\": {\"list_join\": [\"\\n\", [\"['Nova_cell_v2'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::base::nova::api\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/nova_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec nova_api su nova -s /bin/bash -c '/usr/bin/nova-manage api_db sync'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/nova_api_ensure_default_cells.json\": {\"command\": \"/usr/bin/bootstrap_host_exec nova_api su nova -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/nova_api_ensure_default_cells.py'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/nova_api_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/nova_wait_for_api_service.json\": {\"command\": \"/usr/bin/bootstrap_host_exec nova_api su nova -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/nova_wait_for_api_service.py'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}}, \"container_config_scripts\": {\"map_merge\": [{\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, {\"nova_wait_for_api_service.py\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_wait_for_api_service.py\"}}, \"nova_api_ensure_default_cells.py\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_api_ensure_default_cells.py\"}}}]}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"NovaApiLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"nova_api_db_sync\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"nova_api_ensure_default_cells\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaApiImage\"]}, \"user\": \"root\", \"net\": \"host\", \"privileged\": false, \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_api_ensure_default_cells.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\", \"/var/lib/container-config-scripts:/container-config-scripts:z\"]]}, \"environment\": {\"__OS_DEBUG\": {\"yaql\": {\"expression\": \"str($.data.debug)\", \"data\": {\"debug\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\", \"nova::logging::debug\"]}}}}, \"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, \"step_4\": {\"nova_api\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"nova_wait_for_api_service\": {\"start_order\": 3, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaApiImage\"]}, \"user\": \"root\", \"net\": \"host\", \"privileged\": false, \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_wait_for_api_service.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\", \"/var/lib/container-config-scripts:/container-config-scripts:z\"]]}, \"environment\": {\"__OS_DEBUG\": {\"yaql\": {\"expression\": \"str($.data.debug)\", \"data\": {\"debug\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\", \"nova::logging::debug\"]}}}}, \"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"nova_api_cron\": {\"start_order\": 4, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron nova\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_api_cron.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, [{\"name\": \"validate nova-api container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_api\"}, \"register\": \"nova_api_infos\", \"failed_when\": [\"nova_api_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_api_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 4\"]}]]}, \"host_prep_tasks\": {\"get_attr\": [\"NovaApiLogging\", \"host_prep_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop nova api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"nova_api\", \"nova_api_cron\"], \"tripleo_delegate_to\": \"{{ groups['nova_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_statedir_ownership.py": "#!/usr/bin/python3\n#\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\nimport logging\nimport os\nimport pwd\nimport selinux\nimport stat\nimport sys\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('nova_statedir')\n\n\nclass PathManager(object):\n    \"\"\"Helper class to manipulate ownership of a given path\"\"\"\n    def __init__(self, path):\n        self.path = path\n        self.uid = None\n        self.gid = None\n        self.is_dir = None\n        self.secontext = None\n        self._update()\n\n    def _update(self):\n        try:\n            statinfo = os.stat(self.path)\n            self.is_dir = stat.S_ISDIR(statinfo.st_mode)\n            self.uid = statinfo.st_uid\n            self.gid = statinfo.st_gid\n            self.secontext = selinux.lgetfilecon(self.path)[1]\n        except Exception:\n            LOG.exception('Could not update metadata for %s', self.path)\n            raise\n\n    def __str__(self):\n        return \"uid: {} gid: {} path: {}{}\".format(\n            self.uid,\n            self.gid,\n            self.path,\n            '/' if self.is_dir else ''\n        )\n\n    def has_owner(self, uid, gid):\n        return self.uid == uid and self.gid == gid\n\n    def has_either(self, uid, gid):\n        return self.uid == uid or self.gid == gid\n\n    def chown(self, uid, gid):\n        target_uid = -1\n        target_gid = -1\n        if self.uid != uid:\n            target_uid = uid\n        if self.gid != gid:\n            target_gid = gid\n        if (target_uid, target_gid) != (-1, -1):\n            LOG.info('Changing ownership of %s from %d:%d to %d:%d',\n                     self.path,\n                     self.uid,\n                     self.gid,\n                     self.uid if target_uid == -1 else target_uid,\n                     self.gid if target_gid == -1 else target_gid)\n            try:\n                os.chown(self.path, target_uid, target_gid)\n                self._update()\n            except Exception:\n                LOG.exception('Could not change ownership of %s: ',\n                              self.path)\n                raise\n        else:\n            LOG.info('Ownership of %s already %d:%d',\n                     self.path,\n                     uid,\n                     gid)\n\n    def chcon(self, context):\n        # If dir returns whether to recusively set context\n        try:\n            try:\n                selinux.lsetfilecon(self.path, context)\n                LOG.info('Setting selinux context of %s to %s',\n                     self.path, context)\n                return True\n            except OSError as e:\n                if self.is_dir and e.errno == 95:\n                    # Operation not supported, assume NFS mount and skip\n                    LOG.info('Setting selinux context not supported for %s',\n                             self.path)\n                    return False\n                else:\n                    raise\n        except Exception:\n            LOG.exception('Could not set selinux context of %s to %s:',\n                          self.path, context)\n            raise\n\n\nclass NovaStatedirOwnershipManager(object):\n    \"\"\"Class to manipulate the ownership of the nova statedir (/var/lib/nova).\n\n       The nova uid/gid differ on the host and container images. An upgrade\n       that switches from host systemd services to docker requires a change in\n       ownership. Previously this was a naive recursive chown, however this\n       causes issues if nova instance are shared via an NFS mount: any open\n       filehandles in qemu/libvirt fail with an I/O error (LP1778465).\n\n       Instead the upgrade/FFU ansible tasks now lay down a marker file when\n       stopping and disabling the host systemd services. We use this file to\n       determine the host nova uid/gid. We then walk the tree and update any\n       files that have the host uid/gid to the docker nova uid/gid. As files\n       owned by root/qemu etc... are ignored this avoids the issues with open\n       filehandles. The marker is removed once the tree has been walked.\n\n       For subsequent runs, or for a new deployment, we simply ensure that the\n       docker nova user/group owns all directories. This is required as the\n       directories are created with root ownership in host_prep_tasks (the\n       docker nova uid/gid is not known in this context).\n    \"\"\"\n    def __init__(self, statedir, upgrade_marker='upgrade_marker',\n                 nova_user='nova', secontext_marker='../_nova_secontext',\n                 exclude_paths=None):\n        self.statedir = statedir\n        self.nova_user = nova_user\n\n        self.upgrade_marker_path = os.path.join(statedir, upgrade_marker)\n        self.secontext_marker_path = os.path.normpath(os.path.join(statedir, secontext_marker))\n        self.upgrade = os.path.exists(self.upgrade_marker_path)\n\n        self.exclude_paths = [self.upgrade_marker_path]\n        if exclude_paths is not None:\n            for p in exclude_paths:\n                if not p.startswith(os.path.sep):\n                    p = os.path.join(self.statedir, p)\n                self.exclude_paths.append(p)\n\n        self.target_uid, self.target_gid = self._get_nova_ids()\n        self.previous_uid, self.previous_gid = self._get_previous_nova_ids()\n        self.id_change = (self.target_uid, self.target_gid) != \\\n            (self.previous_uid, self.previous_gid)\n        self.target_secontext = self._get_secontext()\n\n    def _get_nova_ids(self):\n        nova_uid, nova_gid = pwd.getpwnam(self.nova_user)[2:4]\n        return nova_uid, nova_gid\n\n    def _get_previous_nova_ids(self):\n        if self.upgrade:\n            statinfo = os.stat(self.upgrade_marker_path)\n            return statinfo.st_uid, statinfo.st_gid\n        else:\n            return self._get_nova_ids()\n\n    def _get_secontext(self):\n        if os.path.exists(self.secontext_marker_path):\n            return selinux.lgetfilecon(self.secontext_marker_path)[1]\n        else:\n            return None\n\n    def _walk(self, top, chcon=True):\n        for f in os.listdir(top):\n            pathname = os.path.join(top, f)\n\n            if pathname in self.exclude_paths:\n                continue\n\n            try:\n                pathinfo = PathManager(pathname)\n                LOG.info(\"Checking %s\", pathinfo)\n                if pathinfo.is_dir:\n                    # Always chown the directories\n                    pathinfo.chown(self.target_uid, self.target_gid)\n                    chcon_r = chcon\n                    if chcon:\n                        chcon_r = pathinfo.chcon(self.target_secontext)\n                    self._walk(pathname, chcon_r)\n                elif self.id_change:\n                    # Only chown files if it's an upgrade and the file is owned by\n                    # the host nova uid/gid\n                    pathinfo.chown(\n                        self.target_uid if pathinfo.uid == self.previous_uid\n                        else pathinfo.uid,\n                        self.target_gid if pathinfo.gid == self.previous_gid\n                        else pathinfo.gid\n                    )\n                    if chcon:\n                        pathinfo.chcon(self.target_secontext)\n            except Exception:\n                # Likely to have been caused by external systems\n                # interacting with this directory tree,\n                # especially on NFS e.g snapshot dirs.\n                # Just ignore it and continue on to the next entry\n                continue\n\n    def run(self):\n        LOG.info('Applying nova statedir ownership')\n        LOG.info('Target ownership for %s: %d:%d',\n                 self.statedir,\n                 self.target_uid,\n                 self.target_gid)\n\n        pathinfo = PathManager(self.statedir)\n        LOG.info(\"Checking %s\", pathinfo)\n        pathinfo.chown(self.target_uid, self.target_gid)\n        chcon = self.target_secontext is not None\n\n        if chcon:\n            pathinfo.chcon(self.target_secontext)\n\n        self._walk(self.statedir, chcon)\n\n        if self.upgrade:\n            LOG.info('Removing upgrade_marker %s',\n                     self.upgrade_marker_path)\n            os.unlink(self.upgrade_marker_path)\n\n        LOG.info('Nova statedir ownership complete')\n\n\ndef get_exclude_paths():\n    exclude_paths = os.environ.get('NOVA_STATEDIR_OWNERSHIP_SKIP')\n    if exclude_paths is not None:\n        exclude_paths = exclude_paths.split(os.pathsep)\n    return exclude_paths\n\n\nif __name__ == '__main__':\n    NovaStatedirOwnershipManager('/var/lib/nova', exclude_paths=get_exclude_paths()).run()\n", "file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_wait_for_compute_service.py": "#!/usr/bin/python3\n#\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\nimport argparse\nimport logging\nimport os\nimport six\nimport socket\nimport sys\nimport time\n\n\nfrom keystoneauth1 import loading\nfrom keystoneauth1 import session\n\nfrom novaclient import client\n\n# In python3 SafeConfigParser was renamed to ConfigParser and the default\n# for duplicate options default to true. In case of nova it is valid to\n# have duplicate option lines, e.g. passthrough_whitelist which leads to\n# issues reading the nova.conf\n# https://bugs.launchpad.net/tripleo/+bug/1827775\nif six.PY3:\n    from six.moves.configparser import ConfigParser\n    config = ConfigParser(strict=False)\nelse:\n    from six.moves.configparser import SafeConfigParser\n    config = SafeConfigParser()\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('nova_wait_for_compute_service')\n\niterations = 60\ntimeout = 10\nnova_cfg = '/etc/nova/nova.conf'\n\nif __name__ == '__main__':\n    parser = argparse.ArgumentParser(usage='%(prog)s [options]')\n    parser.add_argument('-k', '--insecure',\n                        action=\"store_false\",\n                        dest='insecure',\n                        default=True,\n                        help='Allow insecure connection when using SSL')\n\n    args = parser.parse_args()\n    LOG.debug('Running with parameter insecure = %s',\n              args.insecure)\n\n    if os.path.isfile(nova_cfg):\n        try:\n            config.read(nova_cfg)\n        except Exception:\n            LOG.exception('Error while reading nova.conf:')\n    else:\n        LOG.error('Nova configuration file %s does not exist', nova_cfg)\n        sys.exit(1)\n\n    my_host = config.get('DEFAULT', 'host')\n    if not my_host:\n        # If host isn't set nova defaults to this\n        my_host = socket.gethostname()\n\n    loader = loading.get_plugin_loader('password')\n    auth = loader.load_from_options(\n        auth_url=config.get('neutron',\n                            'auth_url'),\n        username=config.get('neutron',\n                            'username'),\n        password=config.get('neutron',\n                            'password'),\n        project_name=config.get('neutron',\n                                'project_name'),\n        project_domain_name=config.get('neutron',\n                                       'project_domain_name'),\n        user_domain_name=config.get('neutron',\n                                    'user_domain_name'))\n    sess = session.Session(auth=auth, verify=args.insecure)\n    nova = client.Client('2.11', session=sess, endpoint_type='internal',\n                         region_name=config.get('neutron', 'region_name'))\n\n    # Wait until this host is listed in the service list\n    for i in range(iterations):\n        try:\n            service_list = nova.services.list(binary='nova-compute')\n            for entry in service_list:\n                host = getattr(entry, 'host', '')\n                zone = getattr(entry, 'zone', '')\n                if host == my_host and zone != 'internal':\n                    LOG.info('Nova-compute service registered')\n                    sys.exit(0)\n            LOG.info('Waiting for nova-compute service to register')\n        except Exception:\n            LOG.exception(\n                'Error while waiting for nova-compute service to register')\n        time.sleep(timeout)\nsys.exit(1)\n\n# vim: set et ts=4 sw=4 :\n", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-compute-common-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Contains a static list of common things necessary for nova-compute containers\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"NovaAdditionalCell\": {\"default\": false, \"description\": \"Whether this is an cell additional to the default cell.\", \"type\": \"boolean\"}}, \"outputs\": {\"container_config_scripts\": {\"description\": \"Shared docker config scripts\", \"value\": {\"nova_statedir_ownership.py\": {\"mode\": \"0700\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_statedir_ownership.py\"}}, \"nova_wait_for_compute_service.py\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_wait_for_compute_service.py\"}}}}, \"nova_compute_common_deploy_steps_tasks\": {\"description\": \"Common host prep tasks for nova-compute services (compute + ironic)\", \"value\": [{\"block\": [{\"name\": \"is additonal Cell?\", \"set_fact\": {\"nova_additional_cell\": {\"get_param\": \"NovaAdditionalCell\"}}}, {\"name\": \"check if discover hosts is required\", \"when\": [\"not nova_additional_cell|bool\", \"nova_cellv2_discovery_done is not defined\"], \"block\": [{\"name\": \"discover via nova_manager?\", \"set_fact\": {\"nova_cellv2_discovery_delegate_host\": \"{{ groups['nova_manager'][0] }}\", \"nova_cellv2_discovery_container\": \"nova_manager\"}, \"when\": [\"groups['nova_manager'] is defined and (groups['nova_manager']|length>0)\"]}, {\"name\": \"discover via nova_api?\", \"set_fact\": {\"nova_cellv2_discovery_delegate_host\": \"{{ groups['nova_api'][0] }}\", \"nova_cellv2_discovery_container\": \"nova_api\"}, \"when\": [\"nova_cellv2_discovery_delegate_host is not defined\", \"groups['nova_api'] is defined and (groups['nova_api']|length>0)\"]}, {\"name\": \"Warn if no discovery host available\", \"fail\": {\"msg\": \"No hosts available to run nova cell_v2 host discovery.\"}, \"ignore_errors\": true, \"when\": [\"nova_cellv2_discovery_delegate_host is not defined\"]}, {\"name\": \"Discovering nova hosts\", \"command\": \"{{ container_cli }} exec {{ nova_cellv2_discovery_container }} nova-manage cell_v2 discover_hosts --by-service\", \"become\": true, \"changed_when\": false, \"delegate_to\": \"{{ nova_cellv2_discovery_delegate_host }}\", \"when\": [\"nova_cellv2_discovery_delegate_host is defined\"]}, {\"set_fact\": {\"nova_cellv2_discovery_done\": true}}]}]}]}}}", "file:///root/tripleo-heat-installer-templates/scripts/delay-nova-compute": "#!/usr/libexec/platform-python\n\"\"\"\nThis wrapper was created to add an optional delay to the startup of nova-compute.\nWe know that instances will fail to boot, after a compute reboot, if ceph is not\nhealthy.\n\nIdeally, we would poll ceph to get its health, but it's not guaranteed that the\ncompute node will have access to the keys.\n\"\"\"\n\nimport os\nimport sys\nimport time\nimport logging\nimport argparse\n\nparser = argparse.ArgumentParser(description='Process some integers.')\nparser.add_argument('--config-file', dest='nova_config', action='store',\n                    default=\"/etc/nova/nova.conf\",\n                    help='path to nova configuration (default: /etc/nova/nova.conf)')\nparser.add_argument('--nova-binary', dest='nova_binary', action='store',\n                    default=\"/usr/bin/nova-compute\",\n                    help='path to nova compute binary (default: /usr/bin/nova-compute)')\nparser.add_argument('--delay', dest='delay', action='store',\n                    default=120, type=int,\n                    help='Number of seconds to wait until nova-compute is started')\nparser.add_argument('--state-dir', dest='state_dir', action='store',\n                    default=\"/run/nova/startup\", help='state-file directory')\nparser.add_argument('--state-file', dest='state_file', action='store',\n                    default=\"nova-compute-delayed\",\n                    help='file exists if we already delayed nova-compute startup')\n\n\nsections = {}\n(args, remaining) = parser.parse_known_args(sys.argv)\n\nreal_args = [args.nova_binary, '--config-file', args.nova_config]\nreal_args.extend(remaining[1:])\n\nif not os.path.isdir(args.state_dir):\n  os.makedirs(args.state_dir, mode = 0o751)\n\nstate_file_name = os.path.join(args.state_dir, args.state_file)\n\nif not os.path.isfile(state_file_name):\n    logging.info(\"Delaying nova-compute startup by %s seconds\" % args.delay)\n    time.sleep(args.delay)\n    open(state_file_name, 'a').close()\n\nlogging.info(\"Executing %s\" % real_args)\nos.execv(args.nova_binary, real_args)\n", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-compute-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova Compute service\\n\", \"parameters\": {\"ContainerNovaComputeImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaLibvirtConfigImage\": {\"description\": \"The container image to use for the nova_libvirt config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"DockerNovaComputeUlimit\": {\"default\": [\"nofile=131072\", \"memlock=67108864\"], \"description\": \"ulimit for Nova Compute Container\", \"type\": \"comma_delimited_list\"}, \"NovaComputeLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.nova.compute\", \"file\": \"/var/log/containers/nova/nova-compute.log\"}}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"CinderRbdMultiConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring multiple RBD backends. The\\nhash key is the backend name, and the value is a dictionary of parameter\\nvalues unique to that backend. The following parameters are required,\\nand must match the corresponding value defined in CephExternalMultiConfig.\\n  CephClusterName (must match the CephExternalMultiConfig entry's 'cluster')\\n  CephClusterFSID (must match the CephExternalMultiConfig entry's 'fsid')\\nThe following parameters are optional, and override the corresponding\\nparameter's default value.\\n  CephClientUserName\\n  CinderRbdPoolName\\n  CinderRbdExtraPools\\n  CinderRbdAvailabilityZone\\n  CinderRbdFlattenVolumeFromSnapshot\\n\"}, \"NovaComputeOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"NovaComputeOptEnvVars\": {\"default\": {}, \"description\": \"hash of optional environment variables\", \"type\": \"json\", \"tags\": [\"role_specific\"]}, \"NovaComputeStartupDelay\": {\"default\": 0, \"description\": \"Delays the startup of nova-compute service after compute node is booted. This is to give a chance to ceph to get back healthy before booting instances after and overcloud reboot.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 0, \"max\": 600}}], \"tags\": [\"role_specific\"]}, \"EnableInstanceHA\": {\"default\": false, \"description\": \"Whether to enable an Instance Ha configurarion or not. This setup requires the Compute role to have the PacemakerRemote service added to it.\", \"type\": \"boolean\"}, \"NovaRbdPoolName\": {\"default\": \"vms\", \"type\": \"string\", \"description\": \"The pool name for RBD backend ephemeral storage.\", \"tags\": [\"role_specific\"]}, \"CephClientKey\": {\"description\": \"The Ceph client key. Can be created with ceph-authtool --gen-print-key.\", \"type\": \"string\", \"hidden\": true, \"constraints\": [{\"allowed_pattern\": \"^[a-zA-Z0-9+/]{38}==$\"}]}, \"CephClusterFSID\": {\"type\": \"string\", \"description\": \"The Ceph cluster FSID. Must be a UUID.\"}, \"CinderEnableNfsBackend\": {\"default\": false, \"description\": \"Whether to enable or not the NFS backend for Cinder\", \"type\": \"boolean\"}, \"NovaMkisofsCmd\": {\"default\": \"mkisofs\", \"description\": \"Name or path of the tool used for ISO image creation.\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaNfsEnabled\": {\"default\": false, \"description\": \"Whether to enable or not the NFS backend for Nova\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaNfsShare\": {\"default\": \"\", \"description\": \"NFS share to mount for nova storage (when NovaNfsEnabled is true)\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaNfsOptions\": {\"default\": \"context=system_u:object_r:nfs_t:s0\", \"description\": \"NFS mount options for nova storage (when NovaNfsEnabled is true)\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaNfsVersion\": {\"default\": \"4.2\", \"description\": \"NFS version used for nova storage (when NovaNfsEnabled is true). Since NFSv3 does not support full locking a NFSv4 version need to be used.\\n\", \"type\": \"string\", \"constraints\": [{\"allowed_pattern\": \"^4.?[0-9]?\"}], \"tags\": [\"role_specific\"]}, \"CinderEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable or not the Rbd backend for Cinder\", \"type\": \"boolean\"}, \"NovaEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable the Rbd backend for Nova ephemeral storage.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaComputeForceRawImages\": {\"default\": true, \"description\": \"Set to \\\"True\\\" to convert non-raw cached base images to raw format.\\nSet to \\\"False\\\" if you have a system with slow I/O or low available space,\\ntrading the higher CPU requirements of compression for that of minimized input\\nbandwidth.\\nNotes::\\n- The Compute service removes any compression from the base image during\\n  compression, to avoid CPU bottlenecks. Converted images cannot have backing\\n  files, which might be a security issue.\\n- The raw image format uses more space than other image formats, for example,\\n  qcow2.\\n  Raw base images are always used with libvirt_images_type=lvm.\\n\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaComputeUseCowImages\": {\"default\": true, \"description\": \"Set to \\\"True\\\" to use CoW (Copy on Write) images in cqow2 format for libvirt\\ninstance disks. With CoW, depending on the backing store and host caching,\\nthere might be better concurrency achieved by having each instance operate\\non its own copy.\\nSet to \\\"False\\\" to use the raw format. Raw format uses more space for common\\nparts of the disk image.\\n\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaComputeLibvirtPreAllocateImages\": {\"default\": \"none\", \"description\": \"Specifies the preallocation mode for libvirt instance disks.\\nSet to one of the following valid values::\\n- none - No storage is provisioned at instance start.\\n- space - Storage is fully allocated at instance start using fallocate,\\n          which can help with both space guarantees and I/O performance.\\n\\nEven when not using CoW instance disks, the copy each instance gets is sparse\\nand so the instance might fail unexpectedly at run time with ENOSPC. By\\nrunning fallocate(1) on the instance disk images, the Compute service\\nimmediately and efficiently allocates the space for them in the file system,\\nif supported. Run time performance should also be improved because the file\\nsystem does not have to dynamically allocate blocks at run time, which reduces\\nCPU overhead and file fragmentation.\\n\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"none\", \"space\"]}], \"tags\": [\"role_specific\"]}, \"NovaComputeImageCacheManagerInterval\": {\"default\": 2400, \"description\": \"Specifies the number of seconds to wait between runs of the image cache\\nmanager, which impacts base image caching on Compute nodes. This period\\nis used in the auto removal of unused cached images configured with\\nremove_unused_base_images and remove_unused_original_minimum_age_seconds.\\n\\nSet to \\\"0\\\" to run at the default interval of 60 seconds (not recommended)\\n\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": -1}}], \"tags\": [\"role_specific\"]}, \"NovaComputeImageCacheRemoveUnusedBaseImages\": {\"default\": true, \"description\": \"Set to \\\"True\\\" to automatically remove unused base images from the cache\\nat intervals configured by using image_cache_manager_interval. Images\\nare defined as unused if they have not been accessed during the time\\nspecified by using remove_unused_original_minimum_age_seconds.\\n\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaComputeImageCacheRemoveUnusedResizedMinimumAge\": {\"default\": 3600, \"description\": \"Specifies the minimum age that an unused resized base image must be to\\nbe removed from the cache, in seconds. Unused unresized base images\\nyounger than this will not be removed.\\n\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1}}], \"tags\": [\"role_specific\"]}, \"NovaComputeImageCachePrecacheConcurrency\": {\"default\": 1, \"description\": \"Maximum number of Compute nodes to trigger image precaching in parallel.\\nWhen an image precache request is made, Compute nodes are contacted {by\\nwho/which service} to initiate the download.\\n\\nHigher numbers will cause more computes to work in parallel and may result\\nin reduced time to complete the operation, but may also DDoS the image\\nservice. Lower numbers will result in more sequential operation, lower\\nimage service load, but likely longer runtime to completion.\\n\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1}}], \"tags\": [\"role_specific\"]}, \"NovaPCIPassthrough\": {\"description\": \"List of PCI Passthrough whitelist parameters. Example - NovaPCIPassthrough:\\n  - vendor_id: \\\"8086\\\"\\n    product_id: \\\"154c\\\"\\n    address: \\\"0000:05:00.0\\\"\\n    physical_network: \\\"datacentre\\\"\\nFor different formats, refer to the nova.conf documentation for pci_passthrough_whitelist configuration\\n\", \"type\": \"json\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaComputeCpuSharedSet\": {\"description\": \"The behavior of this option depends on the deprecated `NovaVcpuPinSet` option:\\n\\n* `NovaVcpuPinSet` is not set: `NovaComputeCpuSharedSet` is set to a\\n  comma-separated list or range of physical host CPU numbers used to:\\n\\n  - provide vCPU inventory\\n  - determine the host CPUs that unpinned instances can be scheduled to\\n  - determine the host CPUS that instance emulator threads should be\\n    offloaded to for instances configured with the share emulator thread\\n    policy, `hw:emulator_threads_policy=share`\\n\\n* `NovaVcpuPinSet` is set: `NovaComputeCpuSharedSet` is set to a list or\\n  range of host CPU cores used to determine the host CPUs that instance\\n  emulator threads should be offloaded to for instances configured with\\n  the share emulator thread policy (`hw:emulator_threads_policy=share`).\\n  In this case, `NovaVcpuPinSet` is used to provide vCPU inventory and to\\n  determine the host CPUs that both pinned and unpinned instances can be\\n  scheduled to.\\n\\nEx. NovaComputeCpuSharedSet: [4-12,^8,15] will reserve cores from 4-12\\nand 15, excluding 8.\\n\", \"type\": \"comma_delimited_list\", \"default\": [], \"tags\": [\"role_specific\"]}, \"NovaComputeCpuDedicatedSet\": {\"description\": \"A list or range of host CPU cores to which processes for pinned instance CPUs (PCPUs) can be scheduled. Ex. NovaComputeCpuDedicatedSet: [4-12,^8,15] will reserve cores from 4-12 and 15, excluding 8.\\n\", \"type\": \"comma_delimited_list\", \"default\": [], \"tags\": [\"role_specific\"]}, \"NovaReservedHostMemory\": {\"description\": \"Reserved RAM for host processes.\\n\", \"type\": \"number\", \"default\": 4096, \"constraints\": [{\"range\": {\"min\": 512}}], \"tags\": [\"role_specific\"]}, \"NovaReservedHugePages\": {\"description\": \"A list of valid key=value which reflect NUMA node ID, page size (Default unit is KiB) and number of pages to be reserved. Example - NovaReservedHugePages: [\\\"node:0,size:2048,count:64\\\",\\\"node:1,size:1GB,count:1\\\"] will reserve on NUMA node 0 64 pages of 2MiB and on NUMA node 1 1 page of 1GiB\\n\", \"type\": \"comma_delimited_list\", \"default\": [], \"tags\": [\"role_specific\"]}, \"KernelArgs\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Kernel Args to apply to the host\", \"tags\": [\"role_specific\"]}, \"OvsDpdkSocketMemory\": {\"default\": \"\", \"description\": \"Sets the amount of hugepage memory to assign per NUMA node. It is recommended to use the socket closest to the PCIe slot used for the desired DPDK NIC.  The format should be in \\\"<socket 0 mem>, <socket 1 mem>, <socket n mem>\\\", where the value is specified in MB.  For example: \\\"1024,0\\\".\\n\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"MonitoringSubscriptionNovaCompute\": {\"default\": \"overcloud-nova-compute\", \"type\": \"string\"}, \"MigrationSshKey\": {\"type\": \"json\", \"description\": \"SSH key for migration. Expects a dictionary with keys 'public_key' and 'private_key'. Values should be identical to SSH public/private key files.\\n\", \"default\": {\"public_key\": \"\", \"private_key\": \"\"}}, \"MigrationSshPort\": {\"default\": 2022, \"description\": \"Target port for migration over ssh\", \"type\": \"number\"}, \"VerifyGlanceSignatures\": {\"default\": false, \"description\": \"Whether to verify image signatures.\", \"type\": \"boolean\"}, \"NovaAutoDisabling\": {\"default\": \"10\", \"description\": \"Max number of consecutive build failures before the nova-compute will disable itself.\", \"type\": \"string\"}, \"NeutronPhysnetNUMANodesMapping\": {\"description\": \"Map of physnet name as key and NUMA nodes as value.\\nEx. NeutronPhysnetNUMANodesMapping: {'foo': [0, 1], 'bar': [1]} where `foo` and `bar` are\\nphysnet names and corresponding values are list of associated numa_nodes.\\n\", \"type\": \"json\", \"default\": {}, \"tags\": [\"role_specific\"]}, \"NeutronTunnelNUMANodes\": {\"description\": \"Used to configure NUMA affinity for all tunneled networks.\", \"type\": \"comma_delimited_list\", \"default\": [], \"tags\": [\"role_specific\"]}, \"NovaResumeGuestsStateOnHostBoot\": {\"default\": false, \"description\": \"Whether to start running instance on compute host reboot\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaLibvirtRxQueueSize\": {\"description\": \"virtio-net RX queue size. Valid values are 256, 512, 1024\\n\", \"default\": 512, \"type\": \"number\", \"constraints\": [{\"allowed_values\": [256, 512, 1024]}], \"tags\": [\"role_specific\"]}, \"NovaLibvirtTxQueueSize\": {\"description\": \"virtio-net TX queue size. Valid values are 256, 512, 1024\\n\", \"default\": 512, \"type\": \"number\", \"constraints\": [{\"allowed_values\": [256, 512, 1024]}], \"tags\": [\"role_specific\"]}, \"NovaLibvirtFileBackedMemory\": {\"description\": \"Available capacity in MiB for file-backed memory. When configured, the ``NovaRAMAllocationRatio`` and ``NovaReservedHostMemory`` parameters must be set to 0.\\n\", \"default\": 0, \"type\": \"number\", \"tags\": [\"role_specific\"]}, \"NovaLibvirtVolumeUseMultipath\": {\"default\": false, \"description\": \"Whether to enable or not the multipath connection of the volumes.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaHWMachineType\": {\"description\": \"To specify a default machine type per host architecture.\\n\", \"default\": \"x86_64=pc-q35-rhel9.0.0\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"NovaAdditionalCell\": {\"default\": false, \"description\": \"Whether this is an cell additional to the default cell.\", \"type\": \"boolean\"}, \"NovaComputeEnableKsm\": {\"default\": false, \"description\": \"Whether to enable KSM on compute nodes or not. Especially in NFV use case one wants to keep it disabled.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"AdminPassword\": {\"description\": \"The password for the keystone admin account, used for monitoring, querying neutron etc.\", \"type\": \"string\", \"hidden\": true}, \"CinderPassword\": {\"description\": \"The password for the cinder service and db account.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"NovaLibvirtNumPciePorts\": {\"description\": \"Set `num_pcie_ports` to specify the number of PCIe ports an instance will get. Libvirt allows a custom number of PCIe ports (pcie-root-port controllers) a target instance will get. Some will be used by default, rest will be available for hotplug use.\\n\", \"default\": 16, \"type\": \"number\", \"tags\": [\"role_specific\"]}, \"NovaLibvirtMemStatsPeriodSeconds\": {\"description\": \"A number of seconds to memory usage statistics period, zero or negative value mean to disable memory usage statistics.\\n\", \"default\": 10, \"type\": \"number\", \"tags\": [\"role_specific\"]}, \"NovaLiveMigrationWaitForVIFPlug\": {\"description\": \"Whether to wait for `network-vif-plugged` events before starting guest transfer.\", \"default\": true, \"type\": \"boolean\"}, \"NovaLiveMigrationPermitPostCopy\": {\"description\": \"If \\\"True\\\" activates the instance on the destination node before migration is complete, and to set an upper bound on the memory that needs to be transferred. Post copy gets enabled per default if the compute roles is not a realtime role or disabled by this parameter.\\n\", \"default\": true, \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaLiveMigrationPermitAutoConverge\": {\"description\": \"Defaults to \\\"True\\\" to slow down the instance CPU until the memory copy process is faster than the instance's memory writes when the migration performance is slow and might not complete. Auto converge will only be used if this flag is set to True and post copy is not permitted or post copy is unavailable due to the version of libvirt and QEMU.\\n\", \"default\": true, \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"MultipathdEnable\": {\"default\": false, \"description\": \"Whether to enable the multipath daemon\", \"type\": \"boolean\"}, \"NovaCPUAllocationRatio\": {\"type\": \"number\", \"description\": \"Virtual CPU to physical CPU allocation ratio.\", \"default\": 0.0, \"tags\": [\"role_specific\"]}, \"NovaRAMAllocationRatio\": {\"type\": \"number\", \"description\": \"Virtual RAM to physical RAM allocation ratio.\", \"default\": 1.0, \"tags\": [\"role_specific\"]}, \"NovaDiskAllocationRatio\": {\"type\": \"number\", \"description\": \"Virtual disk to physical disk allocation ratio.\", \"default\": 0.0, \"tags\": [\"role_specific\"]}, \"NovaEnableVTPM\": {\"type\": \"boolean\", \"description\": \"Whether to enable support for enumlated Trusted Platform Module (TPM) devices.\\n\", \"default\": false, \"tags\": [\"role_specific\"]}, \"NovaMaxDiskDevicesToAttach\": {\"type\": \"number\", \"description\": \"Maximum number of disk devices allowed to attach to a single server. Note that the number of disks supported by an server depends on the bus used. For example, the ide disk bus is limited to 4 attached devices. The configured maximum is enforced during server create, rebuild, evacuate, unshelve, live migrate, and attach volume. Operators changing this parameter on a compute service that is hosting servers should be aware that it could cause rebuilds to fail, if the maximum is decreased lower than the number of devices already attached to servers. Operators should also be aware that during a cold migration, the configured maximum is only enforced in-place and the destination is not checked before the move. -1 means unlimited\\n\", \"default\": -1, \"tags\": [\"role_specific\"]}, \"NovaPMEMMappings\": {\"type\": \"string\", \"description\": \"PMEM namespace mappings as backend for vPMEM feature. This parameter sets Nova's `pmem_namespaces` configuration options. PMEM namespaces needs to be create manually or with conjunction with `NovaPMEMNamespaces` parameter. Requires format: $LABEL:$NSNAME[|$NSNAME][,$LABEL:$NSNAME[|$NSNAME]].\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaPMEMNamespaces\": {\"type\": \"string\", \"description\": \"Creates PMEM namespaces on the host server using `ndctl` tool through Ansible. Requires format: $SIZE:$NSNAME[,$SIZE:$NSNAME...]. $SIZE supports the suffixes \\\"k\\\" or \\\"K\\\" for KiB, \\\"m\\\" or \\\"M\\\" for MiB, \\\"g\\\" or \\\"G\\\" for GiB and \\\"t\\\" or \\\"T\\\" for TiB. NOTE: This requires properly configured NVDIMM regions and enough space for requested namespaces.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaImageCacheTTL\": {\"type\": \"number\", \"description\": \"Time in seconds that nova compute should continue caching an image once it is no longer used by any instances on the host\\n\", \"default\": 86400, \"tags\": [\"role_specific\"]}, \"NovaVGPUTypesDeviceAddressesMapping\": {\"type\": \"json\", \"description\": \"Map of vgpu type(s) the instances can get as key and list of corresponding device addresses as value. Ex. NovaVGPUTypesDeviceAddressesMapping: {'nvidia-35': ['0000:84:00.0', '0000:85:00.0'],\\n                                  'nvidia-36': ['0000:86:00.0']}\\nwhere `nvidia-35` and `nvidia-36` are vgpu types and corresponding values are list of associated device addresses.\\n\", \"default\": {}, \"tags\": [\"role_specific\"]}, \"NovaComputeDisableIrqBalance\": {\"default\": false, \"description\": \"Whether to disable irqbalance on compute nodes or not. Especially in Realtime Compute role one wants to keep it disabled.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaLibvirtCPUMode\": {\"type\": \"string\", \"description\": \"The libvirt CPU mode to configure. Defaults to 'host-model' if virt_type is set to kvm, otherwise defaults to 'none'\\n\", \"default\": \"host-model\", \"constraints\": [{\"allowed_values\": [\"custom\", \"host-model\", \"none\", \"host-passthrough\"]}], \"tags\": [\"role_specific\"]}, \"NovaLibvirtCPUModels\": {\"type\": \"comma_delimited_list\", \"description\": \"The named libvirt CPU model (see names listed in /usr/share/libvirt/cpu_map.xml). Only has effect if cpu_mode=\\\"custom\\\" and virt_type=\\\"kvm|qemu\\\"\\n\", \"default\": [], \"tags\": [\"role_specific\"]}, \"NovaLibvirtCPUModelExtraFlags\": {\"type\": \"string\", \"description\": \"This allows specifying granular CPU feature flags when specifying CPU models. Only has effect if cpu_mode is not set to 'none'.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaDisableImageDownloadToRbd\": {\"type\": \"boolean\", \"description\": \"Refuse to boot an instance if it would require downloading from glance and uploading to ceph instead of a COW clone.\\n\", \"default\": false, \"tags\": [\"role_specific\"]}, \"NovaDisableComputeServiceCheckForFfu\": {\"type\": \"boolean\", \"description\": \"Facilitate a Fast-Forward upgrade where new control services are being started before compute nodes have been able to update their service record.\\n\", \"default\": false}, \"NovaStatedirOwnershipSkip\": {\"type\": \"comma_delimited_list\", \"description\": \"List of paths relative to nova_statedir to ignore when recursively setting the ownership and selinux context.\\n\", \"default\": [\"triliovault-mounts\"]}, \"NovaImageTypeExcludeList\": {\"type\": \"comma_delimited_list\", \"description\": \"List of image formats that should not be advertised as supported by the compute service.\\n\", \"default\": [], \"tags\": [\"role_specific\"]}, \"NovaLibvirtMaxQueues\": {\"type\": \"number\", \"description\": \"Add parameter to configure the libvirt max_queues. The maximum number of virtio queue pairs that can be enabled when creating a multiqueue guest. The number of virtio queues allocated will be the lesser of the CPUs requested by the guest and the max value defined. Default 0 corresponds to not set\\n\", \"default\": 0, \"tags\": [\"role_specific\"]}, \"GlanceRbdPoolName\": {\"default\": \"images\", \"type\": \"string\"}, \"GlanceMultistoreConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring additional glance backends. The\\nhash key is the backend ID, and the value is a dictionary of parameter\\nvalues unique to that backend. Multiple rbd and cinder backends are allowed, but\\nfile and swift backends are limited to one each. Example:\\n  # Default glance store is rbd.\\n  GlanceBackend: rbd\\n  GlanceStoreDescription: 'Default rbd store'\\n  # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder\\n  # backend.\\n  GlanceMultistoreConfig:\\n    rbd2_store:\\n      GlanceBackend: rbd\\n      GlanceStoreDescription: 'Second rbd store'\\n      CephClusterName: ceph2\\n      # Override CephClientUserName if this cluster uses a different\\n      # client name.\\n      CephClientUserName: client2\\n    cinder1_store:\\n      GlanceBackend: cinder\\n      GlanceCinderVolumeType: 'volume-type-1'\\n      GlanceStoreDescription: 'First cinder store'\\n    cinder2_store:\\n      GlanceBackend: cinder\\n      GlanceCinderVolumeType: 'volume-type-2'\\n      GlanceStoreDescription: 'Seconde cinder store'\\n\"}, \"NovaGlanceEnableRbdDownload\": {\"type\": \"boolean\", \"description\": \"Enable download of Glance images directly via RBD.\\n\", \"default\": false, \"tags\": [\"role_specific\"]}, \"NovaGlanceRbdDownloadMultistoreID\": {\"type\": \"string\", \"description\": \"The hash key, which is the backend ID, of the GlanceMultistoreConfig to be used for the role where NovaGlanceEnableRbdDownload is enabled and defaults should be overridden. If CephClientUserName or GlanceRbdPoolName are not set in the GlanceMultistoreConfig, the global values of those parameters will be used.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"GlanceBackendID\": {\"type\": \"string\", \"default\": \"default_backend\", \"description\": \"The default backend's identifier.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9_-]+\"}]}, \"NovaGlanceRbdCopyPollInterval\": {\"type\": \"number\", \"description\": \"The interval in seconds with which to poll Glance after asking for it to copy an image to the local rbd store.\\n\", \"default\": 15, \"tags\": [\"role_specific\"]}, \"NovaGlanceRbdCopyTimeout\": {\"type\": \"number\", \"description\": \"The overall maximum time we will wait for Glance to complete an image copy to our local rbd store.\\n\", \"default\": 600, \"tags\": [\"role_specific\"]}, \"CustomProviderInventories\": {\"description\": \"Array of hashes describing the custom providers for the compute role.\\nFormat:\\nname/uuid - Resource providers to target can be identified by either\\nUUID or name. In addition, the value $COMPUTE_NODE can be used in\\nthe UUID field to identify all nodes managed by the service.\\nExactly one of uuid or name is mandatory. If neither uuid or name\\nis provided, the special uuid $COMPUTE_NODE gets set in the template.\\n\\ninventories - (Optional) Hash of custom provider inventories. 'total' is\\na mandatory property. Any other optional properties not populated will\\nbe given a default value by placement. If overriding a pre-existing\\nprovider values will not be preserved from the existing inventory.\\n\\ntraits - (Optional) Array of additional traits.\\nExample:\\nComputeParameters:\\n  CustomProviderInventories:\\n    - uuid: $COMPUTE_NODE\\n      inventories:\\n        CUSTOM_EXAMPLE_RESOURCE_CLASS:\\n          total: 100\\n          reserved: 0\\n          min_unit: 1\\n          max_unit: 10\\n          step_size: 1\\n          allocation_ratio: 1.0\\n        CUSTOM_ANOTHER_EXAMPLE_RESOURCE_CLASS:\\n          total: 100\\n      traits:\\n        - CUSTOM_P_STATE_ENABLED\\n        - CUSTOM_C_STATE_ENABLED\\n\", \"type\": \"json\", \"default\": {}, \"tags\": [\"role_specific\"]}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"UseTLSTransportForLiveMigration\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will set the libvirt URI's transport to tls and configure the relevant keys for libvirt.\"}, \"NovaVcpuPinSet\": {\"description\": \"A list or range of host CPU cores to which processes for unpinned instance CPUs (VCPUs) can be scheduled, if NovaCpuSharedSet is set, or to which both emulator threads and processes for unpinned instance CPUs (VCPUs) can be scheduled, if NovaCpuSharedSet is unset. Ex. NovaVcpuPinSet: ['4-12','^8'] will reserve cores from 4-12 excluding 8\\n\", \"type\": \"comma_delimited_list\", \"default\": [], \"tags\": [\"role_specific\"]}, \"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"RbdDiskCachemodes\": {\"type\": \"comma_delimited_list\", \"default\": [\"network=writeback\"], \"description\": \"Disk cachemodes for RBD backend.\\n\"}, \"AuthCloudName\": {\"description\": \"Entry in clouds.yaml to use for authentication\", \"type\": \"string\", \"default\": \"\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenstack mailing list.\\n\", \"parameters\": [\"NovaVcpuPinSet\"]}], \"conditions\": {\"auth_cloud_name_set\": {\"not\": {\"equals\": [{\"get_param\": \"AuthCloudName\"}, \"\"]}}, \"compute_startup_delay\": {\"and\": [{\"not\": {\"get_param\": \"EnableInstanceHA\"}}, {\"not\": {\"and\": [{\"equals\": [{\"get_param\": \"NovaComputeStartupDelay\"}, 0]}, {\"or\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaComputeStartupDelay\"]}, 0]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaComputeStartupDelay\"]}, \"\"]}]}]}}]}, \"use_tls_for_live_migration\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForLiveMigration\"}]}, \"enable_live_migration_tunnelled\": {\"and\": [{\"or\": [{\"and\": [{\"get_param\": \"NovaNfsEnabled\"}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaNfsEnabled\"]}, \"\"]}]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaNfsEnabled\"]}, true]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaEnableRbdBackend\"]}, true]}, {\"and\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaEnableRbdBackend\"]}, \"\"]}, {\"get_param\": \"NovaEnableRbdBackend\"}]}]}, {\"not\": \"use_tls_for_live_migration\"}]}, \"libvirt_file_backed_memory_enabled\": {\"not\": {\"and\": [{\"equals\": [{\"get_param\": \"NovaLibvirtFileBackedMemory\"}, 0]}, {\"or\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaLibvirtFileBackedMemory\"]}, 0]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaLibvirtFileBackedMemory\"]}, \"\"]}]}]}}, \"reserved_huge_pages_set\": {\"not\": {\"and\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaReservedHugePages\"]}, \"\"]}, {\"equals\": [{\"get_param\": \"NovaReservedHugePages\"}, []]}]}}, \"is_realtime\": {\"equals\": [{\"get_param\": [\"RoleParameters\", \"TunedProfileName\"]}, \"realtime-virtual-host\"]}, \"ovs_dpdk_socket_memory_not_set\": {\"and\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}, \"\"]}, {\"equals\": [{\"get_param\": \"OvsDpdkSocketMemory\"}, \"\"]}]}, \"nova_libvirt_max_queues_set\": {\"not\": {\"and\": [{\"equals\": [{\"get_param\": \"NovaLibvirtMaxQueues\"}, 0]}, {\"or\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaLibvirtMaxQueues\"]}, \"\"]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaLibvirtMaxQueues\"]}, 0]}]}]}}, \"glance_enable_rbd_download_set\": {\"or\": [{\"and\": [{\"get_param\": \"NovaGlanceEnableRbdDownload\"}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaGlanceEnableRbdDownload\"]}, \"\"]}]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaGlanceEnableRbdDownload\"]}, true]}]}, \"nova_glance_rbd_download_multistore_id_set\": {\"not\": {\"and\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaGlanceRbdDownloadMultistoreID\"]}, \"\"]}, {\"equals\": [{\"get_param\": \"NovaGlanceRbdDownloadMultistoreID\"}, \"\"]}]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"CinderNVMeOF\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backend-nvmeof-puppet.yaml\"}, \"NovaComputeCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-compute-common-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaCommon\", \"properties\": {\"ContainerNovaImage\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaComputeImage\"]}, \"NovaServiceName\": \"compute\"}}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"nova::compute::vcpu_pin_set\": \"NovaVcpuPinSet\", \"nova::compute::cpu_shared_set\": \"NovaComputeCpuSharedSet\", \"nova::compute::cpu_dedicated_set\": \"NovaComputeCpuDedicatedSet\", \"nova::compute::reserved_host_memory\": \"NovaReservedHostMemory\", \"nova::compute::reserved_huge_pages\": \"NovaReservedHugePages\", \"nova::compute::neutron_physnets_numa_nodes_mapping\": \"NeutronPhysnetNUMANodesMapping\", \"nova::compute::neutron_tunnel_numa_nodes\": \"NeutronTunnelNUMANodes\", \"nova::compute::resume_guests_state_on_host_boot\": \"NovaResumeGuestsStateOnHostBoot\", \"nova::compute::libvirt::rx_queue_size\": \"NovaLibvirtRxQueueSize\", \"nova::compute::libvirt::tx_queue_size\": \"NovaLibvirtTxQueueSize\", \"nova::compute::libvirt::file_backed_memory\": \"NovaLibvirtFileBackedMemory\", \"nova::compute::libvirt::volume_use_multipath\": \"NovaLibvirtVolumeUseMultipath\", \"nova::compute::libvirt::hw_machine_type\": \"NovaHWMachineType\", \"nova::compute::mkisofs_cmd\": \"NovaMkisofsCmd\", \"compute_enable_ksm\": \"NovaComputeEnableKsm\", \"nova::compute::rbd::libvirt_images_rbd_pool\": \"NovaRbdPoolName\", \"tripleo::profile::base::nova::compute::nova_nfs_enabled\": \"NovaNfsEnabled\", \"nfs_backend_enable\": \"NovaNfsEnabled\", \"nfs_share\": \"NovaNfsShare\", \"nfs_options\": \"NovaNfsOptions\", \"nfs_vers\": \"NovaNfsVersion\", \"nova::compute::libvirt::num_pcie_ports\": \"NovaLibvirtNumPciePorts\", \"nova::compute::libvirt::mem_stats_period_seconds\": \"NovaLibvirtMemStatsPeriodSeconds\", \"nova::compute::rbd::ephemeral_storage\": \"NovaEnableRbdBackend\", \"resume_guests_state_on_host_boot\": \"NovaResumeGuestsStateOnHostBoot\", \"nova::cpu_allocation_ratio\": \"NovaCPUAllocationRatio\", \"nova::ram_allocation_ratio\": \"NovaRAMAllocationRatio\", \"nova::disk_allocation_ratio\": \"NovaDiskAllocationRatio\", \"nova::compute::max_disk_devices_to_attach\": \"NovaMaxDiskDevicesToAttach\", \"nova::compute::libvirt::pmem_namespaces\": \"NovaPMEMMappings\", \"nova_pmem_namespaces\": \"NovaPMEMNamespaces\", \"nova::compute::image_cache::remove_unused_original_minimum_age_seconds\": \"NovaImageCacheTTL\", \"nova::compute::libvirt::swtpm_enabled\": \"NovaEnableVTPM\", \"nova::compute::vgpu::vgpu_types_device_addresses_mapping\": \"NovaVGPUTypesDeviceAddressesMapping\", \"compute_disable_irqbalance\": \"NovaComputeDisableIrqBalance\", \"nova::compute::libvirt::cpu_mode\": \"NovaLibvirtCPUMode\", \"nova::compute::libvirt::cpu_models\": \"NovaLibvirtCPUModels\", \"nova::compute::libvirt::cpu_model_extra_flags\": \"NovaLibvirtCPUModelExtraFlags\", \"nova_compute_opt_volumes\": \"NovaComputeOptVolumes\", \"nova_compute_startup_delay\": \"NovaComputeStartupDelay\", \"nova_compute_opt_env_vars\": \"NovaComputeOptEnvVars\", \"nova::workarounds::never_download_image_if_on_rbd\": \"NovaDisableImageDownloadToRbd\", \"nova::compute::image_type_exclude_list\": \"NovaImageTypeExcludeList\", \"nova_permit_post_copy\": \"NovaLiveMigrationPermitPostCopy\", \"nova_permit_auto_converge\": \"NovaLiveMigrationPermitAutoConverge\", \"nova_libvirt_max_queues\": \"NovaLibvirtMaxQueues\", \"nova_glance_enable_rbd_download\": \"NovaGlanceEnableRbdDownload\", \"nova_glance_rbd_download_multistore_id\": \"NovaGlanceRbdDownloadMultistoreID\", \"nova::compute::force_raw_images\": \"NovaComputeForceRawImages\", \"nova::compute::use_cow_images\": \"NovaComputeUseCowImages\", \"nova::compute::libvirt::preallocate_images\": \"NovaComputeLibvirtPreAllocateImages\", \"nova::compute::image_cache::manager_interval\": \"NovaComputeImageCacheManagerInterval\", \"nova::compute::image_cache::remove_unused_base_images\": \"NovaComputeImageCacheRemoveUnusedBaseImages\", \"nova::compute::image_cache::remove_unused_resized_minimum_age_seconds\": \"NovaComputeImageCacheRemoveUnusedResizedMinimumAge\", \"nova::compute::image_cache::precache_concurrency\": \"NovaComputeImageCachePrecacheConcurrency\", \"nova::compute::provider::custom_inventories\": \"CustomProviderInventories\", \"nova::compute::rbd::libvirt_images_rbd_glance_copy_poll_interval\": \"NovaGlanceRbdCopyPollInterval\", \"nova::compute::rbd::libvirt_images_rbd_glance_copy_timeout\": \"NovaGlanceRbdCopyTimeout\", \"ContainerNovaComputeImage\": \"ContainerNovaComputeImage\", \"ContainerNovaLibvirtConfigImage\": \"ContainerNovaLibvirtConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NovaVcpuPinSet\": {\"get_param\": \"NovaVcpuPinSet\"}, \"NovaComputeCpuSharedSet\": {\"get_param\": \"NovaComputeCpuSharedSet\"}, \"NovaComputeCpuDedicatedSet\": {\"get_param\": \"NovaComputeCpuDedicatedSet\"}, \"NovaReservedHostMemory\": {\"get_param\": \"NovaReservedHostMemory\"}, \"NovaReservedHugePages\": {\"if\": [\"reserved_huge_pages_set\", {\"get_param\": \"NovaReservedHugePages\"}, {\"if\": [\"ovs_dpdk_socket_memory_not_set\", {\"get_param\": \"NovaReservedHugePages\"}, {\"repeat\": {\"for_each\": {\"<%node%>\": {\"yaql\": {\"expression\": \"range(0,len($.data.dpdk_p)).join(\\\",\\\").split(\\\",\\\")\", \"data\": {\"dpdk_p\": {\"if\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}, \"\"]}, {\"str_split\": [\",\", {\"get_param\": \"OvsDpdkSocketMemory\"}]}, {\"str_split\": [\",\", {\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}]}]}}}}, \"<%size%>\": {\"yaql\": {\"expression\": \"let(hzx => regex(\\\"([0-9]+[K|M|G])\\\").search($.data.kern_p+$.data.kern_g)) -> let(hz =>switch($hzx = \\\"4K\\\" => \\\"4\\\", $hzx = \\\"2M\\\" => \\\"2048\\\", $hzx = \\\"1G\\\" => \\\"1048576\\\", $hzx  => \\\"2048\\\", $hzx = null => \\\"2048\\\")) -> [$hz]*len($.data.dpdk_p)\", \"data\": {\"dpdk_p\": {\"if\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}, \"\"]}, {\"str_split\": [\",\", {\"get_param\": \"OvsDpdkSocketMemory\"}]}, {\"str_split\": [\",\", {\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}]}]}, \"kern_p\": {\"get_param\": [\"RoleParameters\", \"KernelArgs\"]}, \"kern_g\": {\"get_param\": \"KernelArgs\"}}}}, \"<%count%>\": {\"yaql\": {\"expression\": \"let(hzx => regex(\\\"([0-9]+[K|M|G])\\\").search($.data.kern_p+$.data.kern_g)) -> let(hz =>int(switch($hzx = \\\"4K\\\" => \\\"4\\\", $hzx = \\\"2M\\\" => \\\"2048\\\", $hzx = \\\"1G\\\" => \\\"1048576\\\", $hzx  => \\\"2048\\\", $hzx = null => \\\"2048\\\"))) -> $.data.dpdk_p.select(int($)*1024/$hz).join(\\\",\\\").split(',')\", \"data\": {\"dpdk_p\": {\"if\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}, \"\"]}, {\"str_split\": [\",\", {\"get_param\": \"OvsDpdkSocketMemory\"}]}, {\"str_split\": [\",\", {\"get_param\": [\"RoleParameters\", \"OvsDpdkSocketMemory\"]}]}]}, \"kern_p\": {\"get_param\": [\"RoleParameters\", \"KernelArgs\"]}, \"kern_g\": {\"get_param\": \"KernelArgs\"}}}}}, \"template\": \"node:<%node%>,size:<%size%>,count:<%count%>\", \"permutations\": false}}]}]}, \"NeutronPhysnetNUMANodesMapping\": {\"get_param\": \"NeutronPhysnetNUMANodesMapping\"}, \"NeutronTunnelNUMANodes\": {\"get_param\": \"NeutronTunnelNUMANodes\"}, \"NovaResumeGuestsStateOnHostBoot\": {\"get_param\": \"NovaResumeGuestsStateOnHostBoot\"}, \"NovaLibvirtRxQueueSize\": {\"get_param\": \"NovaLibvirtRxQueueSize\"}, \"NovaLibvirtTxQueueSize\": {\"get_param\": \"NovaLibvirtTxQueueSize\"}, \"NovaLibvirtFileBackedMemory\": {\"get_param\": \"NovaLibvirtFileBackedMemory\"}, \"NovaLibvirtVolumeUseMultipath\": {\"get_param\": \"NovaLibvirtVolumeUseMultipath\"}, \"NovaHWMachineType\": {\"get_param\": \"NovaHWMachineType\"}, \"NovaComputeEnableKsm\": {\"get_param\": \"NovaComputeEnableKsm\"}, \"NovaRbdPoolName\": {\"get_param\": \"NovaRbdPoolName\"}, \"NovaMkisofsCmd\": {\"get_param\": \"NovaMkisofsCmd\"}, \"NovaNfsEnabled\": {\"get_param\": \"NovaNfsEnabled\"}, \"NovaNfsShare\": {\"get_param\": \"NovaNfsShare\"}, \"NovaNfsOptions\": {\"get_param\": \"NovaNfsOptions\"}, \"NovaNfsVersion\": {\"get_param\": \"NovaNfsVersion\"}, \"NovaLibvirtNumPciePorts\": {\"get_param\": \"NovaLibvirtNumPciePorts\"}, \"NovaLibvirtMemStatsPeriodSeconds\": {\"get_param\": \"NovaLibvirtMemStatsPeriodSeconds\"}, \"NovaEnableRbdBackend\": {\"get_param\": \"NovaEnableRbdBackend\"}, \"NovaCPUAllocationRatio\": {\"get_param\": \"NovaCPUAllocationRatio\"}, \"NovaRAMAllocationRatio\": {\"get_param\": \"NovaRAMAllocationRatio\"}, \"NovaDiskAllocationRatio\": {\"get_param\": \"NovaDiskAllocationRatio\"}, \"NovaEnableVTPM\": {\"get_param\": \"NovaEnableVTPM\"}, \"NovaMaxDiskDevicesToAttach\": {\"get_param\": \"NovaMaxDiskDevicesToAttach\"}, \"NovaPMEMMappings\": {\"get_param\": \"NovaPMEMMappings\"}, \"NovaPMEMNamespaces\": {\"get_param\": \"NovaPMEMNamespaces\"}, \"NovaImageCacheTTL\": {\"get_param\": \"NovaImageCacheTTL\"}, \"NovaVGPUTypesDeviceAddressesMapping\": {\"get_param\": \"NovaVGPUTypesDeviceAddressesMapping\"}, \"NovaComputeDisableIrqBalance\": {\"get_param\": \"NovaComputeDisableIrqBalance\"}, \"NovaLibvirtCPUMode\": {\"get_param\": \"NovaLibvirtCPUMode\"}, \"NovaLibvirtCPUModels\": {\"get_param\": \"NovaLibvirtCPUModels\"}, \"NovaLibvirtCPUModelExtraFlags\": {\"get_param\": \"NovaLibvirtCPUModelExtraFlags\"}, \"NovaComputeOptVolumes\": {\"get_param\": \"NovaComputeOptVolumes\"}, \"NovaComputeStartupDelay\": {\"get_param\": \"NovaComputeStartupDelay\"}, \"NovaComputeOptEnvVars\": {\"get_param\": \"NovaComputeOptEnvVars\"}, \"NovaDisableImageDownloadToRbd\": {\"get_param\": \"NovaDisableImageDownloadToRbd\"}, \"NovaImageTypeExcludeList\": {\"get_param\": \"NovaImageTypeExcludeList\"}, \"NovaLiveMigrationPermitPostCopy\": {\"get_param\": \"NovaLiveMigrationPermitPostCopy\"}, \"NovaLiveMigrationPermitAutoConverge\": {\"get_param\": \"NovaLiveMigrationPermitAutoConverge\"}, \"NovaLibvirtMaxQueues\": {\"get_param\": \"NovaLibvirtMaxQueues\"}, \"NovaGlanceEnableRbdDownload\": {\"get_param\": \"NovaGlanceEnableRbdDownload\"}, \"NovaGlanceRbdDownloadMultistoreID\": {\"get_param\": \"NovaGlanceRbdDownloadMultistoreID\"}, \"NovaComputeForceRawImages\": {\"get_param\": \"NovaComputeForceRawImages\"}, \"NovaComputeUseCowImages\": {\"get_param\": \"NovaComputeUseCowImages\"}, \"NovaComputeLibvirtPreAllocateImages\": {\"get_param\": \"NovaComputeLibvirtPreAllocateImages\"}, \"NovaComputeImageCacheManagerInterval\": {\"get_param\": \"NovaComputeImageCacheManagerInterval\"}, \"NovaComputeImageCacheRemoveUnusedBaseImages\": {\"get_param\": \"NovaComputeImageCacheRemoveUnusedBaseImages\"}, \"NovaComputeImageCacheRemoveUnusedResizedMinimumAge\": {\"get_param\": \"NovaComputeImageCacheRemoveUnusedResizedMinimumAge\"}, \"NovaComputeImageCachePrecacheConcurrency\": {\"get_param\": \"NovaComputeImageCachePrecacheConcurrency\"}, \"CustomProviderInventories\": {\"get_param\": \"CustomProviderInventories\"}, \"NovaGlanceRbdCopyPollInterval\": {\"get_param\": \"NovaGlanceRbdCopyPollInterval\"}, \"NovaGlanceRbdCopyTimeout\": {\"get_param\": \"NovaGlanceRbdCopyTimeout\"}, \"ContainerNovaComputeImage\": {\"get_param\": \"ContainerNovaComputeImage\"}, \"ContainerNovaLibvirtConfigImage\": {\"get_param\": \"ContainerNovaLibvirtConfigImage\"}}}]}}}}, \"outputs\": {\"nova_compute_host_prep_and_system_upgrade_post_tasks\": {\"description\": \"Common host_prep and system_upgrade post tasks for nova_compute\", \"value\": [{\"name\": \"Mount Nova NFS Share\", \"vars\": {\"nfs_backend_enable\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_backend_enable\"]}, \"nfs_share\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_share\"]}, \"nfs_options\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_options\"]}, \"nfs_vers\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_vers\"]}}, \"mount\": {\"name\": \"/var/lib/nova/instances\", \"state\": \"mounted\", \"fstype\": \"nfs4\", \"src\": \"{{nfs_share}}\", \"opts\": \"_netdev,bg,{{nfs_options}},nfsvers={{nfs_vers}}\"}, \"when\": \"nfs_backend_enable|bool\"}]}, \"role_data\": {\"description\": \"Role data for the Nova Compute service.\", \"value\": {\"service_name\": \"nova_compute\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaCompute\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaLogging\", \"config_settings\"]}, {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\"]}, {\"nova::compute::libvirt::manage_libvirt_services\": false, \"nova::compute::pci::passthrough\": {\"str_replace\": {\"template\": \"JSON_PARAM\", \"params\": {\"map_replace\": [{\"map_replace\": [{\"JSON_PARAM\": \"NovaPCIPassthrough\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NovaPCIPassthrough\": {\"get_param\": \"NovaPCIPassthrough\"}}}]}}}, \"nova::compute::libvirt::migration_support\": false, \"tripleo::profile::base::nova::migration::client::nova_compute_enabled\": true, \"tripleo::profile::base::nova::migration::client::ssh_private_key\": {\"get_param\": [\"MigrationSshKey\", \"private_key\"]}, \"tripleo::profile::base::nova::migration::client::ssh_port\": {\"get_param\": \"MigrationSshPort\"}, \"nova::compute::rbd::libvirt_images_rbd_glance_store_name\": {\"get_param\": \"GlanceBackendID\"}, \"nova::compute::rbd::libvirt_images_rbd_ceph_conf\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"nova::compute::rbd::libvirt_rbd_user\": {\"get_param\": \"CephClientUserName\"}, \"nova::compute::rbd::rbd_keyring\": {\"list_join\": [\".\", [\"client\", {\"get_param\": \"CephClientUserName\"}]]}, \"tripleo::profile::base::nova::compute::cinder_nfs_backend\": {\"get_param\": \"CinderEnableNfsBackend\"}, \"rbd_persistent_storage\": {\"get_param\": \"CinderEnableRbdBackend\"}, \"rbd_disk_cachemodes\": {\"get_param\": \"RbdDiskCachemodes\"}, \"nova::cinder::username\": \"cinder\", \"nova::cinder::auth_type\": \"v3password\", \"nova::cinder::project_name\": \"service\", \"nova::cinder::password\": {\"get_param\": \"CinderPassword\"}, \"nova::cinder::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"nova::cinder::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::compute::rbd::libvirt_rbd_secret_key\": {\"get_param\": \"CephClientKey\"}, \"nova::compute::rbd::libvirt_rbd_secret_uuid\": {\"get_param\": \"CephClusterFSID\"}, \"nova::compute::instance_usage_audit\": true, \"nova::compute::instance_usage_audit_period\": \"hour\", \"nova::compute::consecutive_build_service_disable_threshold\": {\"get_param\": \"NovaAutoDisabling\"}, \"nova::compute::live_migration_wait_for_vif_plug\": {\"get_param\": \"NovaLiveMigrationWaitForVIFPlug\"}, \"nova::migration::libvirt::live_migration_permit_post_copy\": {\"if\": [\"is_realtime\", false, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_permit_post_copy\"]}]}, \"nova::migration::libvirt::live_migration_permit_auto_converge\": {\"if\": [\"is_realtime\", false, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_permit_auto_converge\"]}]}, \"nova::migration::libvirt::live_migration_tunnelled\": false, \"nova::compute::vncserver_proxyclient_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"nova::compute::vncproxy_host\": {\"get_param\": [\"EndpointMap\", \"NovaPublic\", \"host_nobrackets\"]}, \"nova::vncproxy::common::vncproxy_protocol\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyCellPublic\", \"protocol\"]}, \"nova::vncproxy::common::vncproxy_host\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyCellPublic\", \"host_nobrackets\"]}, \"nova::vncproxy::common::vncproxy_port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyCellPublic\", \"port\"]}, \"nova::compute::verify_glance_signatures\": {\"get_param\": [\"VerifyGlanceSignatures\"]}, \"nova::ram_allocation_ratio\": {\"if\": [\"libvirt_file_backed_memory_enabled\", \"1.0\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova::ram_allocation_ratio\"]}]}, \"nova::compute::libvirt::max_queues\": {\"if\": [\"nova_libvirt_max_queues_set\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_max_queues\"]}]}, \"nova::workarounds::disable_compute_service_check_for_ffu\": {\"get_param\": \"NovaDisableComputeServiceCheckForFfu\"}}, {\"if\": [\"glance_enable_rbd_download_set\", {\"nova::glance::enable_rbd_download\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_glance_enable_rbd_download\"]}, \"nova::glance::rbd_user\": {\"if\": [\"nova_glance_rbd_download_multistore_id_set\", {\"yaql\": {\"expression\": \"let(k => $.data.key, d => $.data.default_ceph_client_user_name) -> $.data.multistore.get($k).get(\\\"CephClientUserName\\\", $d)\", \"data\": {\"key\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_glance_rbd_download_multistore_id\"]}, \"multistore\": {\"get_param\": \"GlanceMultistoreConfig\"}, \"default_ceph_client_user_name\": {\"get_param\": \"CephClientUserName\"}}}}, {\"get_param\": \"CephClientUserName\"}]}, \"nova::glance::rbd_pool\": {\"if\": [\"nova_glance_rbd_download_multistore_id_set\", {\"yaql\": {\"expression\": \"let(k => $.data.key, d => $.data.default_glance_rbd_pool_name) -> $.data.multistore.get($k).get(\\\"GlanceRbdPoolName\\\", $d)\", \"data\": {\"key\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_glance_rbd_download_multistore_id\"]}, \"multistore\": {\"get_param\": \"GlanceMultistoreConfig\"}, \"default_glance_rbd_pool_name\": {\"get_param\": \"GlanceRbdPoolName\"}}}}, {\"get_param\": \"GlanceRbdPoolName\"}]}, \"nova::glance::rbd_ceph_conf\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"if\": [\"nova_glance_rbd_download_multistore_id_set\", {\"yaql\": {\"expression\": \"let(k => $.data.key) -> list(coalesce($.data.multistore, {}).get($k)).flatten().select($.get(\\\"CephClusterName\\\"))\", \"data\": {\"key\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_glance_rbd_download_multistore_id\"]}, \"multistore\": {\"get_param\": \"GlanceMultistoreConfig\"}}}}, {\"get_param\": \"CephClusterName\"}]}, \".conf\"]]}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_nova_compute\": [{\"get_param\": \"NovaComputeLoggingSource\"}]}, \"collectd\": {\"tripleo.collectd.plugins.nova_compute\": [\"virt\"], \"collectd::plugin::virt::connection\": \"qemu:///system\"}}, \"puppet_config\": {\"config_volume\": \"nova_libvirt\", \"puppet_tags\": \"nova_config\", \"step_config\": \"# TODO(emilien): figure how to deal with libvirt profile.\\n# We'll probably treat it like we do with Neutron plugins.\\n# Until then, just include it in the default nova-compute role.\\ninclude tripleo::profile::base::nova::compute::libvirt\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_compute.json\": {\"command\": {\"list_join\": [\" \", [{\"if\": [\"compute_startup_delay\", {\"str_replace\": {\"template\": \"/var/lib/nova/delay-nova-compute --delay DELAY --nova-binary\", \"params\": {\"DELAY\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_compute_startup_delay\"]}}}}]}, \"/usr/bin/nova-compute\", {\"get_attr\": [\"NovaLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-iscsid/*\", \"dest\": \"/etc/iscsi/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": {\"list_concat\": [[{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"nova:nova\", \"perm\": \"0600\"}], {\"repeat\": {\"template\": {\"path\": \"/etc/ceph/<%keyring%>\", \"owner\": \"nova:nova\", \"perm\": \"0600\"}, \"for_each\": {\"<%keyring%>\": {\"yaql\": {\"expression\": \"let(u => $.data.user) -> $.data.multistore.values().where($.get(\\\"CephClusterName\\\")).select($.CephClusterName + \\\".client.\\\" + $.get(\\\"CephClientUserName\\\", $u) + \\\".keyring\\\")\", \"data\": {\"user\": {\"get_param\": \"CephClientUserName\"}, \"multistore\": {\"get_param\": \"GlanceMultistoreConfig\"}}}}}}}, {\"repeat\": {\"template\": {\"path\": \"/etc/ceph/<%keyring%>\", \"owner\": \"nova:nova\", \"perm\": \"0600\"}, \"for_each\": {\"<%keyring%>\": {\"yaql\": {\"expression\": \"let(u => $.data.default_user) -> $.data.multiconfig.values().select($.CephClusterName + \\\".client.\\\" + $.get(\\\"CephClientUserName\\\", $u) + \\\".keyring\\\")\", \"data\": {\"default_user\": {\"get_param\": \"CephClientUserName\"}, \"multiconfig\": {\"get_param\": \"CinderRbdMultiConfig\"}}}}}}}]}}, \"/var/lib/kolla/config_files/nova_compute_wait_for_compute_service.json\": {\"command\": \"/container-config-scripts/pyshim.sh /container-config-scripts/nova_wait_for_compute_service.py\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}}, \"container_config_scripts\": {\"map_merge\": [{\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, {\"get_attr\": [\"NovaComputeCommon\", \"container_config_scripts\"]}]}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"NovaLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"nova_statedir_owner\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaComputeImage\"]}, \"net\": \"none\", \"user\": \"root\", \"security_opt\": [\"label=disable\"], \"privileged\": false, \"detach\": false, \"volumes\": [\"/var/lib/nova:/var/lib/nova:shared\", \"/var/lib/_nova_secontext:/var/lib/_nova_secontext:shared,z\", \"/var/lib/container-config-scripts:/container-config-scripts:z\"], \"command\": \"/container-config-scripts/pyshim.sh /container-config-scripts/nova_statedir_ownership.py\", \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}, \"__OS_DEBUG\": {\"yaql\": {\"expression\": \"str($.data.debug)\", \"data\": {\"debug\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\", \"nova::logging::debug\"]}}}}, \"NOVA_STATEDIR_OWNERSHIP_SKIP\": {\"list_join\": [\":\", {\"get_param\": \"NovaStatedirOwnershipSkip\"}]}}}}, \"step_5\": {\"map_merge\": [{\"nova_compute\": {\"start_order\": 3, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaComputeImage\"]}, \"ulimit\": {\"get_param\": \"DockerNovaComputeUlimit\"}, \"ipc\": \"host\", \"net\": \"host\", \"privileged\": true, \"user\": \"nova\", \"restart\": \"always\", \"depends_on\": {\"list_concat\": [[\"tripleo_nova_libvirt.target\"], {\"if\": [{\"get_param\": \"NovaNfsEnabled\"}, [\"var-lib-nova-instances.mount\"]]}]}, \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLogging\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_compute_opt_volumes\"]}, [\"/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro\", \"/var/lib/kolla/config_files/nova_compute.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", \"/var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, \"/dev:/dev\", \"/lib/modules:/lib/modules:ro\", \"/run:/run\", \"/run/nova:/run/nova:z\", \"/var/lib/iscsi:/var/lib/iscsi:z\", \"/var/lib/libvirt:/var/lib/libvirt:shared\", \"/sys/class/net:/sys/class/net\", \"/sys/bus/pci:/sys/bus/pci\", \"/boot:/boot:ro\", \"/var/lib/nova:/var/lib/nova:shared\"], {\"if\": [{\"get_param\": \"MultipathdEnable\"}, [\"/etc/multipath:/etc/multipath:z\", \"/etc/multipath.conf:/etc/multipath.conf:ro\"]]}, {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_volumes\"]}]}, \"environment\": {\"map_merge\": [{\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_compute_opt_env_vars\"]}, {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}, {\"LIBGUESTFS_BACKEND\": \"direct\"}]}}}, {\"if\": [{\"not\": {\"get_param\": \"NovaAdditionalCell\"}}, {\"nova_wait_for_compute_service\": {\"start_order\": 4, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaComputeImage\"]}, \"net\": \"host\", \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_compute_wait_for_compute_service.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/nova:/var/log/nova\", \"/var/lib/container-config-scripts:/container-config-scripts\"]]}, \"user\": \"nova\", \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"__OS_DEBUG\": {\"yaql\": {\"expression\": \"str($.data.debug)\", \"data\": {\"debug\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\", \"nova::logging::debug\"]}}}}}}}]}]}}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLogging\", \"host_prep_tasks\"]}, [{\"name\": \"Check for /var/lib/nova/instances directory exitance\", \"stat\": {\"path\": \"/var/lib/nova/instances\"}, \"register\": \"check_nova_instances_result\"}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype | default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/lib/nova\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/_nova_secontext\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/nova/instances\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/libvirt\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/tmpfiles.d\"}]}, {\"name\": \"ensure /run/nova is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-nova.conf\", \"content\": \"d /run/nova 0777 root root - -\\n\"}}, {\"name\": \"create tempfiles\", \"command\": \"systemd-tmpfiles --create\"}], [{\"name\": \"Mount Nova NFS Share\", \"vars\": {\"nfs_backend_enable\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_backend_enable\"]}, \"nfs_share\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_share\"]}, \"nfs_options\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_options\"]}, \"nfs_vers\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_vers\"]}}, \"mount\": {\"name\": \"/var/lib/nova/instances\", \"state\": \"mounted\", \"fstype\": \"nfs4\", \"src\": \"{{nfs_share}}\", \"opts\": \"_netdev,bg,{{nfs_options}},nfsvers={{nfs_vers}}\"}, \"when\": \"nfs_backend_enable|bool\"}], [{\"name\": \"delay installation of systemd-container\", \"when\": \"check_nova_instances_result.stat.exists\", \"block\": [{\"name\": \"check systemd-container package installed or not\", \"package\": {\"name\": \"systemd-container\", \"state\": \"present\"}, \"check_mode\": true, \"register\": \"is_systemd_container_package\", \"failed_when\": false}, {\"name\": \"get latest package from downloaded package versions\", \"shell\": \"ls -1t /var/tmp/systemd-container* | head -1\", \"register\": \"latest_systemd_container_package\", \"when\": [\"is_systemd_container_package is defined\", \"('changed' in is_systemd_container_package)\", \"is_systemd_container_package.changed\"], \"failed_when\": false}, {\"name\": \"Install systemd-container package on boot\", \"copy\": {\"dest\": \"/etc/systemd/system/install-systemd-container.service\", \"content\": \"[Unit]\\nDescription=Install systemd container package on system boot\\nBefore=tripleo_nova_virtqemud.service\\n\\n[Service]\\nType=oneshot\\nExecStart=/usr/bin/rpm -ivh {{ latest_systemd_container_package.stdout }}\\nExecStartPost=rm -f /var/tmp/systemd-container*\\n\\n[Install]\\nWantedBy=multi-user.target\\n\"}, \"when\": [\"latest_systemd_container_package is defined\", \"('stdout' in latest_systemd_container_package)\", \"is_systemd_container_package is defined\", \"('changed' in is_systemd_container_package)\", \"is_systemd_container_package.changed\"]}, {\"name\": \"enable install-systemd-container on compute boot\", \"systemd\": {\"name\": \"install-systemd-container\", \"state\": \"stopped\", \"enabled\": true, \"daemon_reload\": true}, \"when\": [\"is_systemd_container_package is defined\", \"('changed' in is_systemd_container_package)\", \"is_systemd_container_package.changed\"]}, {\"name\": \"check if install-systemd-container service exists\", \"stat\": {\"path\": \"/etc/systemd/system/install-systemd-container.service\"}, \"register\": \"install_systemd_container_result\"}, {\"name\": \"disable and mask install-systemd-container on compute boot\", \"systemd\": {\"name\": \"install-systemd-container\", \"enabled\": false, \"masked\": true, \"daemon_reload\": true}, \"when\": [\"is_systemd_container_package is defined\", \"('changed' in is_systemd_container_package)\", \"not is_systemd_container_package.changed\", \"install_systemd_container_result.stat.exists\"]}]}, {\"name\": \"is Nova Resume Guests State On Host Boot enabled\", \"set_fact\": {\"resume_guests_state_on_host_boot_enabled\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"resume_guests_state_on_host_boot\"]}}}, {\"name\": \"install libvirt-guests systemd unit file (docker)\", \"when\": [\"resume_guests_state_on_host_boot_enabled|bool\", \"container_cli == 'docker'\"], \"block\": [{\"name\": \"libvirt-guests unit to stop nova_compute container before shutdown VMs\", \"copy\": {\"dest\": \"/etc/systemd/system/libvirt-guests.service\", \"content\": \"[Unit]\\nDescription=Suspend/Resume Running libvirt Guests\\nAfter=network.target\\nAfter=time-sync.target\\nAfter=virt-guest-shutdown.target\\nAfter=docker.service\\nAfter=tripleo-container-shutdown.service\\nAfter=rhel-push-plugin.service\\nDocumentation=man:libvirtd(8)\\nDocumentation=https://libvirt.org\\n\\n[Service]\\nEnvironmentFile=-/var/lib/config-data/puppet-generated/nova_libvirt/etc/sysconfig/libvirt-guests\\n# Hack just call traditional service until we factor\\n# out the code\\nExecStart=/bin/{{container_cli}} exec nova_libvirt /bin/sh -x /usr/libexec/libvirt-guests.sh start\\nExecStop=/bin/{{container_cli}} stop nova_compute\\nExecStop=/bin/{{container_cli}}  exec nova_libvirt /bin/sh -x /usr/libexec/libvirt-guests.sh stop\\nType=oneshot\\nRemainAfterExit=yes\\nStandardOutput=journal+console\\nTimeoutStopSec=0\\n\\n[Install]\\nWantedBy=multi-user.target\\n\"}}, {\"name\": \"Making sure virt-guest-shutdown.target is present\", \"copy\": {\"dest\": \"/etc/systemd/system/virt-guest-shutdown.target\", \"content\": \"[Unit]\\nDescription=Libvirt guests shutdown\\nDocumentation=https://libvirt.org\\nAfter=systemd-machined.service\\nAfter=network-online.target\\nAfter=tripleo_nova_libvirt.target\\nBefore=tripleo_nova_compute.service\\n\"}}, {\"name\": \"libvirt-guests enable VM shutdown on compute reboot/shutdown\", \"systemd\": {\"name\": \"libvirt-guests\", \"enabled\": true, \"daemon_reload\": true}}]}, {\"name\": \"install tripleo_nova_libvirt_guests systemd unit file (podman)\", \"when\": [\"resume_guests_state_on_host_boot_enabled|bool\", \"container_cli == 'podman'\"], \"block\": [{\"name\": \"libvirt-guests unit to stop nova_compute container before shutdown VMs (monolithic libvirt)\", \"copy\": {\"dest\": \"/etc/systemd/system/tripleo_nova_libvirt_guests.service\", \"content\": \"[Unit]\\nDescription=Suspend libvirt Guests in tripleo\\nRequires=virt-guest-shutdown.target\\nAfter=systemd-machined.service\\nAfter=network-online.target\\nAfter=tripleo_nova_libvirt.target\\nBefore=tripleo_nova_compute.service\\nDocumentation=man:libvirtd(8)\\nDocumentation=https://libvirt.org\\n\\n[Service]\\nEnvironmentFile=-/etc/sysconfig/libvirt-guests\\nExecStart=/bin/podman exec nova_libvirt /bin/rm -f /var/lib/libvirt/libvirt-guests\\nExecStop=/bin/podman exec nova_libvirt /bin/sh -x /usr/libexec/libvirt-guests.sh shutdown\\nType=oneshot\\nRemainAfterExit=yes\\nStandardOutput=journal+console\\nTimeoutStopSec=0\\n\\n[Install]\\nWantedBy=multi-user.target\\n\"}, \"when\": \"tripleo_nova_libvirt_virsh_container | default('nova_libvirt') == 'nova_libvirt'\"}, {\"name\": \"libvirt-guests unit to stop nova_compute container before shutdown VMs (modular libvirt)\", \"copy\": {\"dest\": \"/etc/systemd/system/tripleo_nova_libvirt_guests.service\", \"content\": \"[Unit]\\nDescription=Suspend libvirt Guests in tripleo\\nRequires=virt-guest-shutdown.target\\nAfter=systemd-machined.service\\nAfter=network-online.target\\nAfter=tripleo_nova_libvirt.target\\nBefore=tripleo_nova_compute.service\\nDocumentation=man:libvirtd(8)\\nDocumentation=https://libvirt.org\\n\\n[Service]\\nEnvironmentFile=-/etc/sysconfig/libvirt-guests\\nExecStart=/bin/podman exec nova_virtproxyd /bin/rm -f /var/lib/libvirt/libvirt-guests\\nExecStop=/bin/podman exec nova_virtproxyd /bin/sh -x /usr/libexec/libvirt-guests.sh shutdown\\nType=oneshot\\nRemainAfterExit=yes\\nStandardOutput=journal+console\\nTimeoutStopSec=0\\n\\n[Install]\\nWantedBy=multi-user.target\\n\"}, \"when\": \"tripleo_nova_libvirt_virsh_container | default('nova_libvirt') != 'nova_libvirt'\"}, {\"name\": \"Making sure virt-guest-shutdown.target is present\", \"copy\": {\"dest\": \"/etc/systemd/system/virt-guest-shutdown.target\", \"content\": \"[Unit]\\nDescription=Libvirt guests shutdown\\nDocumentation=https://libvirt.org\\nAfter=systemd-machined.service\\nAfter=network-online.target\\nAfter=tripleo_nova_libvirt.target\\nBefore=tripleo_nova_compute.service\\n\"}}, {\"name\": \"tripleo_nova_libvirt_guests enable VM shutdown on compute reboot/shutdown\", \"systemd\": {\"name\": \"tripleo_nova_libvirt_guests\", \"enabled\": true, \"daemon_reload\": true}}]}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}, {\"name\": \"Do we prepend nova startup with a delay\", \"set_fact\": {\"nova_compute_delay\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_compute_startup_delay\"]}}}, {\"name\": \"install nova-compute delay wrapper script\", \"copy\": {\"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/scripts/delay-nova-compute\"}, \"dest\": \"/var/lib/nova/delay-nova-compute\", \"mode\": 493}, \"when\": \"nova_compute_delay|int > 0\"}, {\"name\": \"Is irqbalance enabled\", \"set_fact\": {\"compute_irqbalance_disabled\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"compute_disable_irqbalance\"]}}}, {\"name\": \"disable irqbalance service on compute\", \"when\": \"compute_irqbalance_disabled|bool\", \"service\": {\"name\": \"irqbalance.service\", \"state\": \"stopped\", \"enabled\": false}}], {\"get_attr\": [\"CinderNVMeOF\", \"cinder_nvmeof_host_prep_tasks\"]}]}, \"deploy_steps_tasks\": [{\"name\": \"install systemd-container for a greenfield\", \"when\": [\"step|int == 1\", \"not check_nova_instances_result.stat.exists\"], \"package\": {\"name\": \"systemd-container\", \"state\": \"present\"}}, {\"name\": \"validate nova-compute container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_compute\"}, \"register\": \"nova_compute_infos\", \"failed_when\": [\"nova_compute_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_compute_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 6\"]}, {\"name\": \"manage PMEM namespaces for vPMEM\", \"include_role\": {\"name\": \"tripleo_nvdimm\"}, \"vars\": {\"tripleo_nvdimm_pmem_namespaces\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_pmem_namespaces\"]}}, \"when\": [\"step|int == 1\", \"tripleo_nvdimm_pmem_namespaces != ''\"]}, {\"name\": \"manage OS version 9 specific sysctls\", \"when\": [\"step|int == 1\", \"ansible_facts['os_family'] == 'RedHat'\", \"ansible_facts['distribution_major_version'] is version('9', '==')\"], \"block\": [{\"name\": \"Enable post-copy by setting unprivileged_userfaultfd\", \"sysctl\": {\"name\": \"vm.unprivileged_userfaultfd\", \"value\": 1, \"sysctl_set\": true, \"sysctl_file\": \"/etc/sysctl.d/99-tripleo-postcopy.conf\", \"state\": \"present\", \"reload\": true}}]}, {\"name\": \"enable/disable ksm\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"is KSM enabled\", \"set_fact\": {\"compute_ksm_enabled\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"compute_enable_ksm\"]}}}, {\"name\": \"disable KSM on compute\", \"when\": \"not compute_ksm_enabled|bool\", \"block\": [{\"name\": \"Check for ksm\", \"shell\": \"systemctl is-active ksm.service || systemctl is-enabled ksm.service\", \"become\": true, \"failed_when\": false, \"register\": \"ksm_service_check\"}, {\"name\": \"disable KSM services\", \"service\": {\"name\": \"{{ item }}\", \"state\": \"stopped\", \"enabled\": false}, \"with_items\": [\"ksm.service\", \"ksmtuned.service\"], \"when\": [\"ksm_service_check.rc is defined\", \"ksm_service_check.rc == 0\"], \"register\": \"ksmdisabled\"}, {\"name\": \"delete PageKSM after disable ksm on compute\", \"command\": \"echo 2 >/sys/kernel/mm/ksm/run\", \"when\": [\"ksm_service_check.rc is defined\", \"ksm_service_check.rc == 0\", \"ksmdisabled is changed\"]}]}, {\"name\": \"enable KSM on compute\", \"when\": \"compute_ksm_enabled|bool\", \"block\": [{\"name\": \"make sure package providing ksmtuned is installed (RHEL8 or CentOS8)\", \"package\": {\"name\": \"qemu-kvm-common\", \"state\": \"present\"}, \"when\": [\"ansible_facts['distribution_major_version'] is version('8', '==')\"]}, {\"name\": \"make sure package providing ksmtuned is installed (RHEL9 or CentOS9)\", \"package\": {\"name\": \"ksmtuned\", \"state\": \"present\"}, \"when\": [\"ansible_facts['distribution_major_version'] is version('9', '==')\"]}, {\"name\": \"enable ksmtunded\", \"service\": {\"name\": \"{{ item }}\", \"state\": \"started\", \"enabled\": true}, \"with_items\": [\"ksm.service\", \"ksmtuned.service\"]}]}]}], \"external_post_deploy_tasks\": {\"get_attr\": [\"NovaComputeCommon\", \"nova_compute_common_deploy_steps_tasks\"]}, \"upgrade_tasks\": [{\"name\": \"Remove openstack-nova-compute and python-nova package during upgrade\", \"package\": {\"name\": [\"openstack-nova-compute\", \"python-nova\"], \"state\": \"removed\"}, \"failed_when\": false, \"when\": \"step|int == 2\"}, {\"name\": \"nova_compute pre system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 3\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Unmount Nova NFS Share\", \"vars\": {\"nfs_backend_enable\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_backend_enable\"]}}, \"mount\": {\"name\": \"/var/lib/nova/instances\", \"state\": \"absent\", \"fstype\": \"nfs4\"}, \"when\": \"nfs_backend_enable|bool\"}]}, {\"name\": \"nova_compute post system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 5\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Mount Nova NFS Share\", \"vars\": {\"nfs_backend_enable\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_backend_enable\"]}, \"nfs_share\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_share\"]}, \"nfs_options\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_options\"]}, \"nfs_vers\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nfs_vers\"]}}, \"mount\": {\"name\": \"/var/lib/nova/instances\", \"state\": \"mounted\", \"fstype\": \"nfs4\", \"src\": \"{{nfs_share}}\", \"opts\": \"_netdev,bg,{{nfs_options}},nfsvers={{nfs_vers}}\"}, \"when\": \"nfs_backend_enable|bool\"}]}], \"update_tasks\": [{\"name\": \"Remove openstack-nova-compute and python-nova package during upgrade\", \"package\": {\"name\": [\"openstack-nova-compute\", \"python-nova\"], \"state\": \"removed\"}, \"failed_when\": false, \"when\": \"step|int == 2\"}], \"post_update_tasks\": [{\"name\": \"Ensure instanceha directory is purged\", \"when\": \"step|int == 1\", \"become\": true, \"file\": {\"path\": \"/var/lib/nova/instanceha\", \"state\": \"absent\"}}], \"post_upgrade_tasks\": [{\"name\": \"Ensure instanceha directory is purged\", \"when\": \"step|int == 1\", \"become\": true, \"file\": {\"path\": \"/var/lib/nova/instanceha\", \"state\": \"absent\"}}], \"scale_tasks\": [{\"when\": [\"step|int == 1\", \"container_cli == 'podman'\"], \"tags\": \"down\", \"become\": true, \"environment\": {\"OS_CLOUD\": {\"if\": [\"auth_cloud_name_set\", {\"get_param\": \"AuthCloudName\"}, {\"get_param\": \"RootStackName\"}]}}, \"block\": [{\"name\": \"Get nova-compute service ID\", \"command\": \"openstack compute service list --service nova-compute --column ID --column Host --format yaml\", \"register\": \"nova_compute_service_result\", \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false, \"changed_when\": false}, {\"name\": \"is additional Cell?\", \"set_fact\": {\"is_additional_cell\": {\"get_param\": \"NovaAdditionalCell\"}}}, {\"name\": \"Set fact for nova_compute services\", \"set_fact\": {\"nova_compute_service\": \"{{ nova_compute_service_result.stdout | from_yaml | selectattr('Host', 'match', ansible_facts['fqdn'] ~ '.*') | list }}\"}, \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false}, {\"name\": \"Check search output\", \"fail\": {\"msg\": \"Found multiple `{{ ansible_facts['fqdn'] }}`, which is unexpected. This means that the FQDN of the selected device to disable is either wrong or is sharing a name with another host, which is also wrong. Please correct this issue before continuing. Nova service list return data can be found here -> {{ nova_compute_service }}.\"}, \"when\": [\"(nova_compute_service | length) > 1\"]}, {\"name\": \"Disable nova services\", \"when\": [\"(nova_compute_service | length) == 1\"], \"block\": [{\"name\": \"Disable nova-compute service\", \"command\": \"openstack compute service set {{ nova_compute_service[0].Host }} nova-compute --disable\", \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false, \"when\": [\"not is_additional_cell|bool\"]}, {\"name\": \"Stop nova-compute container\", \"service\": {\"name\": \"tripleo_nova_compute\", \"state\": \"stopped\", \"enabled\": false}, \"become\": true, \"register\": \"stop_nova_compute\", \"failed_when\": \"('msg' in stop_nova_compute and 'Could not find the requested service tripleo_nova_compute' not in stop_nova_compute.msg) or ('rc' in stop_nova_compute and stop_nova_compute.rc != 0)\"}, {\"name\": \"Delete nova-compute service\", \"command\": \"openstack compute service delete {{ nova_compute_service[0].ID }}\", \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"check_mode\": false}]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-conductor-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova Conductor service\\n\", \"parameters\": {\"ContainerNovaConductorImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaConfigImage\": {\"description\": \"The container image to use for the nova config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaConductorLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.nova.conductor\", \"file\": \"/var/log/containers/nova/nova-conductor.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"NovaWorkers\": {\"default\": 0, \"description\": \"Number of workers for Nova services.\", \"type\": \"number\"}, \"MonitoringSubscriptionNovaConductor\": {\"default\": \"overcloud-nova-conductor\", \"type\": \"string\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"NovaAdditionalCell\": {\"default\": false, \"description\": \"Whether this is an cell additional to the default cell.\", \"type\": \"boolean\"}}, \"conditions\": {\"nova_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"NovaWorkers\"}, 0]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"NovaLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaCommon\", \"properties\": {\"ContainerNovaImage\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConductorImage\"]}, \"NovaServiceName\": \"conductor\"}}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaApiDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-apidb-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-db-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaConductorImage\": \"ContainerNovaConductorImage\", \"ContainerNovaConfigImage\": \"ContainerNovaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaConductorImage\": {\"get_param\": \"ContainerNovaConductorImage\"}, \"ContainerNovaConfigImage\": {\"get_param\": \"ContainerNovaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova Conductor service.\", \"value\": {\"service_name\": \"nova_conductor\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaConductor\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaLogging\", \"config_settings\"]}, {\"if\": [\"nova_workers_set\", {\"nova::conductor::workers\": {\"get_param\": \"NovaWorkers\"}}]}]}, \"service_config_settings\": {\"rabbitmq\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"service_config_settings\"], \"rabbitmq\": null}, \"mysql\": {\"map_merge\": [{\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}]}, \"rsyslog\": {\"tripleo_logging_sources_nova_conductor\": [{\"get_param\": \"NovaConductorLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"nova\", \"puppet_tags\": \"nova_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::nova::conductor\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_conductor.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/nova-conductor\", {\"get_attr\": [\"NovaLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/nova_conductor_db_sync.json\": {\"command\": {\"str_replace\": {\"template\": \"/usr/bin/bootstrap_host_exec nova_conductor su nova -s /bin/bash -c '/usr/bin/nova-manage db sync DB_SYNC_ARGS'\", \"params\": {\"if\": [{\"get_param\": \"NovaAdditionalCell\"}, {\"DB_SYNC_ARGS\": \"--local_cell\"}, {\"DB_SYNC_ARGS\": \"\"}]}}}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"NovaLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"nova_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConductorImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"start_order\": 3, \"net\": \"host\", \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_conductor_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"]]}, \"user\": \"root\", \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"nova_conductor\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConductorImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_conductor.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"deploy_steps_tasks\": [{\"name\": \"validate nova-conductor container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_conductor\"}, \"register\": \"nova_conductor_infos\", \"failed_when\": [\"nova_conductor_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_conductor_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 5\"]}], \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLogging\", \"host_prep_tasks\"]}, [{\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]]}, \"external_upgrade_tasks\": [{\"when\": \"step|int == 1\", \"block\": [{\"name\": \"Set facts for running online DB migrations\", \"set_fact\": {\"is_additional_cell\": {\"get_param\": \"NovaAdditionalCell\"}}, \"tags\": [\"online_upgrade\", \"online_upgrade_nova\"]}, {\"name\": \"Online data migration for Nova\", \"when\": \"not is_additional_cell|bool\", \"command\": \"{{ container_cli }} exec nova_conductor nova-manage db online_data_migrations\", \"delegate_to\": \"{{ (groups['nova_conductor'] | difference(groups['excluded_overcloud']))[0] }}\", \"become\": true, \"tags\": [\"online_upgrade\", \"online_upgrade_nova\"]}]}, {\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop nova conductor container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"nova_conductor\"], \"tripleo_delegate_to\": \"{{ groups['nova_conductor'] | difference(groups['excluded_overcloud']) }}\"}}]}], \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"block\": [{\"name\": \"Set facts for running online DB migrations\", \"set_fact\": {\"is_additional_cell\": {\"get_param\": \"NovaAdditionalCell\"}}, \"tags\": [\"online_upgrade\", \"online_upgrade_nova\"]}, {\"name\": \"Online data migration for Nova\", \"when\": \"not is_additional_cell|bool\", \"command\": \"{{ container_cli }} exec nova_conductor nova-manage db online_data_migrations\", \"delegate_to\": \"{{ (groups['nova_conductor'] | difference(groups['excluded_overcloud']))[0] }}\", \"become\": true, \"tags\": [\"online_upgrade\", \"online_upgrade_nova\"]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-libvirt-common.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Contains a static list of common things necessary for containers\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry.  This mapping overrides those in ServiceNetMapDefaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CinderRbdMultiConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring multiple RBD backends. The\\nhash key is the backend name, and the value is a dictionary of parameter\\nvalues unique to that backend. The following parameters are required,\\nand must match the corresponding value defined in CephExternalMultiConfig.\\n  CephClusterName (must match the CephExternalMultiConfig entry's 'cluster')\\n  CephClusterFSID (must match the CephExternalMultiConfig entry's 'fsid')\\nThe following parameters are optional, and override the corresponding\\nparameter's default value.\\n  CephClientUserName\\n  CinderRbdPoolName\\n  CinderRbdExtraPools\\n  CinderRbdAvailabilityZone\\n  CinderRbdFlattenVolumeFromSnapshot\\n\"}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"QemuMemoryBackingDir\": {\"type\": \"string\", \"description\": \"Directory used for memoryBacking source if configured as file. NOTE: big files will be stored here\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}}, \"conditions\": {\"memory_backing_dir_set\": {\"not\": {\"and\": [{\"equals\": [{\"get_param\": \"QemuMemoryBackingDir\"}, \"\"]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"QemuMemoryBackingDir\"]}, \"\"]}]}}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"nova::compute::libvirt::qemu::memory_backing_dir\": \"QemuMemoryBackingDir\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"QemuMemoryBackingDir\": {\"get_param\": \"QemuMemoryBackingDir\"}}}]}}}}, \"outputs\": {\"kolla_config_files\": {\"description\": \"Common kolla config_files.\", \"value\": {\"list_concat\": [[{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}]]}}, \"kolla_permissions\": {\"description\": \"Common kolla permissions.\", \"value\": {\"list_concat\": [[{\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"nova:nova\", \"perm\": \"0600\"}], {\"repeat\": {\"template\": {\"path\": \"/etc/ceph/<%keyring%>\", \"owner\": \"nova:nova\", \"perm\": \"0600\"}, \"for_each\": {\"<%keyring%>\": {\"yaql\": {\"expression\": \"let(u => $.data.default_user) -> $.data.multiconfig.values().select($.CephClusterName + \\\".client.\\\" + $.get(\\\"CephClientUserName\\\", $u) + \\\".keyring\\\")\", \"data\": {\"default_user\": {\"get_param\": \"CephClientUserName\"}, \"multiconfig\": {\"get_param\": \"CinderRbdMultiConfig\"}}}}}}}]}}, \"config_settings\": {\"description\": \"Extra hieradata for all modular virt daemons.\", \"value\": {\"get_attr\": [\"RoleParametersValue\", \"value\"]}}, \"volumes\": {\"description\": \"Common volumes for all modular virt daemons.\", \"value\": {\"list_concat\": [[\"/lib/modules:/lib/modules:ro\", \"/dev:/dev\", \"/run:/run\", \"/sys/fs/cgroup:/sys/fs/cgroup\", \"/sys/fs/selinux:/sys/fs/selinux\", \"/etc/selinux/config:/etc/selinux/config:ro\", \"/etc/libvirt:/etc/libvirt:shared\", \"/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/nova:/var/lib/nova:shared\", \"/var/lib/libvirt:/var/lib/libvirt:shared\", \"/var/cache/libvirt:/var/cache/libvirt:shared\", \"/var/lib/vhost_sockets:/var/lib/vhost_sockets\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro\", \"/etc/pki/libvirt:/etc/pki/libvirt:ro\", \"/etc/pki/qemu:/etc/pki/qemu:ro\"]]}, {\"if\": [\"memory_backing_dir_set\", [{\"str_replace\": {\"template\": \"MEMORY_BACKING_DIR:MEMORY_BACKING_DIR\", \"params\": {\"MEMORY_BACKING_DIR\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova::compute::libvirt::qemu::memory_backing_dir\"]}}}}]]}]}}, \"update_tasks\": {\"description\": \"Common update tasks for modular virt daemons\", \"value\": [{\"name\": \"check systemd-container package present or not\", \"package\": {\"name\": \"systemd-container\", \"state\": \"present\"}, \"check_mode\": true, \"register\": \"is_systemd_container_package\"}, {\"name\": \"download systemd-container package if not present\", \"yum\": {\"name\": \"systemd-container\", \"state\": \"present\", \"download_only\": true, \"download_dir\": \"/var/tmp/\"}, \"when\": \"is_systemd_container_package.changed\"}]}}}", "file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_libvirt_init_secret.sh": "#!/usr/bin/bash\n\nset -e\n\nCEPH_INFO=($*)\n\nif [ -z \"$CEPH_INFO\" ]; then\n    echo \"error: At least one CLUSTER:CLIENT tuple must be specified\"\n    exit 1\nfi\n\necho \"------------------------------------------------\"\necho \"Initializing virsh secrets for: ${CEPH_INFO[@]}\"\n\nfor INFO in ${CEPH_INFO[@]}; do\n    IFS=: read CLUSTER CLIENT <<< $INFO\n    if [ ! -f /etc/ceph/${CLUSTER}.conf ]; then\n        echo \"Error: /etc/ceph/${CLUSTER}.conf was not found\"\n        echo \"Path to nova_libvirt_init_secret was ${CEPH_INFO}\"\n        exit 1\n    fi\n    FSID=$(awk '$1 == \"fsid\" {print $3}' /etc/ceph/${CLUSTER}.conf)\n    if [ -z \"${FSID}\" ]; then\n        echo \"Error: /etc/ceph/${CLUSTER}.conf contained an empty fsid definition\"\n        echo \"Check your ceph configuration\"\n        exit 1\n    fi\n\n    echo \"--------\"\n    echo \"Initializing the virsh secret for '$CLUSTER' cluster ($FSID) '$CLIENT' client\"\n\n    # Ensure the secret XML file exists. Puppet should have created a secret.xml\n    # file for the first cluster's secret, so detect when to use that file.\n    if grep -q $FSID /etc/nova/secret.xml; then\n        SECRET_FILE=\"/etc/nova/secret.xml\"\n        SECRET_NAME=\"client.${CLIENT} secret\"\n    else\n        SECRET_FILE=\"/etc/nova/${CLUSTER}-secret.xml\"\n        SECRET_NAME=\"${CLUSTER}.client.${CLIENT} secret\"\n    fi\n\n    if [ ! -f $SECRET_FILE ]; then\n        echo \"Creating $SECRET_FILE\"\n        cat <<EOF > $SECRET_FILE\n<secret ephemeral='no' private='no'>\n  <usage type='ceph'>\n    <name>${SECRET_NAME}</name>\n  </usage>\n  <uuid>${FSID}</uuid>\n</secret>\nEOF\n    else\n        echo \"The $SECRET_FILE file already exists\"\n    fi\n\n    # Ensure the libvirt secret is defined\n    if /usr/bin/virsh secret-list | grep -q $FSID; then\n        echo \"The virsh secret for $FSID has already been defined\"\n    else\n        /usr/bin/virsh secret-define --file $SECRET_FILE\n    fi\n\n    # Fetch the key from the keyring and ensure the secret is set\n    KEY=$(awk '$1 == \"key\" {print $3}' /etc/ceph/${CLUSTER}.client.${CLIENT}.keyring)\n    if /usr/bin/virsh secret-get-value $FSID 2>/dev/null | grep -q $KEY; then\n        echo \"The virsh secret for $FSID has already been set\"\n    else\n        /usr/bin/virsh secret-set-value --secret $FSID --base64 $KEY\n    fi\ndone\n", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-modular-libvirt-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Modular Libvirt Service\\n\", \"parameters\": {\"ContainerNovaLibvirtImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaLibvirtConfigImage\": {\"description\": \"The container image to use for the nova_libvirt config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaLibvirtUlimit\": {\"default\": [\"nofile=131072\", \"nproc=126960\"], \"description\": \"ulimit for Nova Libvirt Container\", \"type\": \"comma_delimited_list\"}, \"ContainerNovaLibvirtPidsLimit\": {\"default\": 65536, \"description\": \"Tune nova_libvirt container PID limit (set to 0 for unlimited) (defaults to 65536)\", \"type\": \"number\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"UseCustomGnuTlsQemuCryptoPolicy\": {\"type\": \"boolean\", \"default\": false, \"description\": \"If set to true, will use CustomGnuTlsQemuCryptoPolicy in crypto policy.\"}, \"CustomGnuTlsQemuCryptoPolicy\": {\"default\": \"QEMU=NONE:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+GROUP-X25519:+GROUP-X448:+GROUP-SECP256R1:+GROUP-SECP384R1:+GROUP-SECP521R1:+GROUP-FFDHE2048:+GROUP-FFDHE3072:+GROUP-FFDHE4096:+GROUP-FFDHE6144:+GROUP-FFDHE8192:+CHACHA20-POLY1305:+AEAD:+SHA1:+SHA512:+SIGN-ECDSA-SHA256:+SIGN-ECDSA-SECP256R1-SHA256:+SIGN-ECDSA-SHA384:+SIGN-ECDSA-SECP384R1-SHA384:+SIGN-ECDSA-SHA512:+SIGN-ECDSA-SECP521R1-SHA512:+SIGN-EdDSA-Ed25519:+SIGN-EdDSA-Ed448:+SIGN-RSA-PSS-SHA256:+SIGN-RSA-PSS-SHA384:+SIGN-RSA-PSS-SHA512:+SIGN-RSA-PSS-RSAE-SHA256:+SIGN-RSA-PSS-RSAE-SHA384:+SIGN-RSA-PSS-RSAE-SHA512:+SIGN-RSA-SHA256:+SIGN-RSA-SHA384:+SIGN-RSA-SHA512:+VERS-TLS1.3:+VERS-TLS1.2:+VERS-DTLS1.2\", \"description\": \"Custom GnuTls Crypto Policy for QEMU\", \"type\": \"string\"}, \"UseTLSTransportForLiveMigration\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will set the libvirt URI's transport to tls and configure the relevant keys for libvirt.\"}, \"NovaEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable the Rbd backend for Nova ephemeral storage.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"CinderEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable or not the Rbd backend for Cinder\", \"type\": \"boolean\"}, \"CephClientKey\": {\"description\": \"The Ceph client key. Can be created with ceph-authtool --gen-print-key.\", \"type\": \"string\", \"hidden\": true, \"constraints\": [{\"allowed_pattern\": \"^[a-zA-Z0-9+/]{38}==$\"}]}, \"CephClusterFSID\": {\"type\": \"string\", \"description\": \"The Ceph cluster FSID. Must be a UUID.\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"CinderRbdMultiConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring multiple RBD backends. The\\nhash key is the backend name, and the value is a dictionary of parameter\\nvalues unique to that backend. The following parameters are required,\\nand must match the corresponding value defined in CephExternalMultiConfig.\\n  CephClusterName (must match the CephExternalMultiConfig entry's 'cluster')\\n  CephClusterFSID (must match the CephExternalMultiConfig entry's 'fsid')\\nThe following parameters are optional, and override the corresponding\\nparameter's default value.\\n  CephClientUserName\\n  CinderRbdPoolName\\n  CinderRbdExtraPools\\n  CinderRbdAvailabilityZone\\n  CinderRbdFlattenVolumeFromSnapshot\\n\"}, \"UseTLSTransportForVnc\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will enable TLS transaport for libvirt VNC and configure the relevant keys for libvirt.\"}, \"UseTLSTransportForNbd\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will enable TLS transaport for libvirt NBD and configure the relevant keys for libvirt.\"}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"LibvirtCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"QemuServerCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"QemuClientCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"LibvirtCACert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"This specifies the CA certificate to use for TLS in libvirt. This file will be symlinked to the default CA path in libvirt, which is /etc/pki/CA/cacert.pem. Note that due to limitations GNU TLS, which is the TLS backend for libvirt, the file must be less than 65K (so we can't use the system's CA bundle). This parameter should be used if the default (which comes from the InternalTLSCAFile parameter) is not desired. The current default reflects TripleO's default CA, which is FreeIPA. It will only be used if internal TLS is enabled.\"}, \"QemuCACert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"This specifies the CA certificate to use for qemu. This file will be symlinked to the default CA path, which is /etc/pki/qemu/ca-cert.pem. This parameter should be used if the default (which comes from the InternalTLSCAFile parameter) is not desired. The current default reflects TripleO's default CA, which is FreeIPA. It will only be used if internal TLS is enabled.\"}, \"VhostuserSocketGroup\": {\"default\": \"qemu\", \"description\": \"The vhost-user socket directory group name. Defaults to 'qemu'. When vhostuser mode is 'dpdkvhostuserclient' (which is the default mode), the vhost socket is created by qemu.\\n\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"QemuMemoryBackingDir\": {\"type\": \"string\", \"description\": \"Directory used for memoryBacking source if configured as file. NOTE: big files will be stored here\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaComputeLibvirtType\": {\"type\": \"string\", \"default\": \"kvm\"}, \"LibvirtEnabledPerfEvents\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"This is a performance event list which could be used as monitor. For example - ``enabled_perf_events = cmt, mbml, mbmt`` The supported events list can be found in https://libvirt.org/html/libvirt-libvirt-domain.html , which you may need to search key words ``VIR_PERF_PARAM_*``\"}, \"MonitoringSubscriptionNovaLibvirt\": {\"default\": \"overcloud-nova-libvirt\", \"type\": \"string\"}, \"MigrationSshKey\": {\"type\": \"json\", \"description\": \"SSH key for migration. Expects a dictionary with keys 'public_key' and 'private_key'. Values should be identical to SSH public/private key files.\\n\", \"default\": {\"public_key\": \"\", \"private_key\": \"\"}}, \"MigrationSshPort\": {\"default\": 2022, \"description\": \"Target port for migration over ssh\", \"type\": \"number\"}, \"LibvirtTLSPassword\": {\"description\": \"The password for the libvirt service when TLS is enabled\", \"type\": \"string\", \"hidden\": true}, \"QemuDefaultTLSVerify\": {\"description\": \"Whether to enable or disable TLS client certificate verification. Enabling this option will reject any client who does not have a certificate signed by the CA in /etc/pki/qemu/ca-cert.pem\\n\", \"default\": true, \"type\": \"boolean\"}, \"LibvirtLogFilters\": {\"description\": \"Defines a filter in libvirt daemon to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:libvirt 1:qemu 1:conf 1:security 3:event 3:json 3:file 3:object 1:util\"}, \"LibvirtVirtlogdLogFilters\": {\"description\": \"Defines a filter in virtlogd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:logging 4:object 4:json 4:event 1:util\"}, \"LibvirtVirtsecretdLogFilters\": {\"description\": \"Defines a filter in virtsecretd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:qemu 1:libvirt 4:object 4:json 4:event 1:util\"}, \"LibvirtVirtnodedevdLogFilters\": {\"description\": \"Defines a filter in virtnodedevd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:qemu 1:libvirt 4:object 4:json 4:event 1:util\"}, \"LibvirtVirtstoragedLogFilters\": {\"description\": \"Defines a filter in virtstoraged to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:qemu 1:libvirt 4:object 4:json 4:event 1:util\"}, \"LibvirtVirtqemudLogFilters\": {\"description\": \"Defines a filter in virtqemud to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:qemu 1:libvirt 4:object 4:json 4:event 1:util\"}, \"LibvirtVirtproxydLogFilters\": {\"description\": \"Defines a filter in virtproxyd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:qemu 1:libvirt 4:object 4:json 4:event 1:util\"}, \"LibvirtTLSPriority\": {\"description\": \"Override the compile time default TLS priority string.\\n\", \"type\": \"string\", \"default\": \"NORMAL:-VERS-SSL3.0:-VERS-TLS-ALL:+VERS-TLS1.2\"}, \"NovaLibvirtOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"NovaEnableVirtlogdContainerWrapper\": {\"description\": \"Generate a virtlogd wrapper script so that virtlogd launches in a separate container and won't get restarted e.g. on minor updates.\", \"type\": \"boolean\", \"default\": true}, \"VirtlogdWrapperDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Controls debugging for the wrapper scripts.\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"RbdDiskCachemodes\": {\"type\": \"comma_delimited_list\", \"default\": [\"network=writeback\"], \"description\": \"Disk cachemodes for RBD backend.\\n\"}}, \"conditions\": {\"use_tls_for_live_migration\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForLiveMigration\"}]}, \"libvirt_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtCACert\"}, \"\"]}}, \"need_libvirt_secret\": {\"or\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaEnableRbdBackend\"]}, true]}, {\"and\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaEnableRbdBackend\"]}, \"\"]}, {\"equals\": [{\"get_param\": \"NovaEnableRbdBackend\"}, true]}]}, {\"get_param\": \"CinderEnableRbdBackend\"}]}, \"use_tls_for_vnc\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForVnc\"}]}, \"libvirt_vnc_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtVncCACert\"}, \"\"]}}, \"use_tls_for_nbd\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForNbd\"}]}, \"qemu_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"QemuCACert\"}, \"\"]}}, \"key_size_libvirt_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtCertificateKeySize\"}, \"\"]}}, \"key_size_qemu_client_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"QemuClientCertificateKeySize\"}, \"\"]}}, \"key_size_qemu_server_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"QemuServerCertificateKeySize\"}, \"\"]}}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"vhostuser_socket_group\": \"VhostuserSocketGroup\", \"nova_libvirt_opt_volumes\": \"NovaLibvirtOptVolumes\", \"ContainerNovaLibvirtImage\": \"ContainerNovaLibvirtImage\", \"ContainerNovaLibvirtConfigImage\": \"ContainerNovaLibvirtConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"VhostuserSocketGroup\": {\"get_param\": \"VhostuserSocketGroup\"}, \"NovaLibvirtOptVolumes\": {\"get_param\": \"NovaLibvirtOptVolumes\"}, \"ContainerNovaLibvirtImage\": {\"get_param\": \"ContainerNovaLibvirtImage\"}, \"ContainerNovaLibvirtConfigImage\": {\"get_param\": \"ContainerNovaLibvirtConfigImage\"}}}]}}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"NovaLibvirtLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaLibvirt\"}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaLibvirtCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-libvirt-common.yaml\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Libvirt service.\", \"value\": {\"service_name\": \"nova_libvirt\", \"firewall_rules\": {\"200 nova_libvirt\": {\"dport\": [16514, \"61152-61215\", \"5900-6923\"]}}, \"ansible_group_vars\": {\"tripleo_nova_libvirt_virsh_container\": \"nova_virtproxyd\"}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaLibvirt\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"config_settings\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"config_settings\"]}, {\"nova::compute::libvirt::manage_libvirt_services\": false, \"tripleo::profile::base::nova::virtlogd_wrapper::enable_wrapper\": {\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo::profile::base::nova::virtlogd_wrapper::virtlogd_process_wrapper\": \"/var/lib/container-config-scripts/virtlogd_wrapper\", \"tripleo::profile::base::nova::virtlogd_wrapper::virtlogd_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"tripleo::profile::base::nova::virtlogd_wrapper::debug\": {\"if\": [{\"get_param\": \"VirtlogdWrapperDebug\"}, true, {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\", \"nova::logging::debug\"]}]}, \"nova::compute::libvirt::migration_support\": false, \"nova::compute::rbd::libvirt_images_rbd_ceph_conf\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"nova::compute::rbd::libvirt_rbd_user\": {\"get_param\": \"CephClientUserName\"}, \"tripleo::profile::base::nova::compute_libvirt_shared::nova_rbd_ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"nova::compute::rbd::rbd_keyring\": {\"list_join\": [\".\", [\"client\", {\"get_param\": \"CephClientUserName\"}]]}, \"nova::compute::rbd::libvirt_rbd_secret_key\": {\"get_param\": \"CephClientKey\"}, \"nova::compute::rbd::libvirt_rbd_secret_uuid\": {\"get_param\": \"CephClusterFSID\"}, \"tripleo::profile::base::nova::migration::client::libvirt_enabled\": true, \"tripleo::profile::base::nova::migration::client::ssh_private_key\": {\"get_param\": [\"MigrationSshKey\", \"private_key\"]}, \"tripleo::profile::base::nova::migration::client::ssh_port\": {\"get_param\": \"MigrationSshPort\"}, \"nova::compute::libvirt::services::libvirt_virt_type\": {\"get_param\": \"NovaComputeLibvirtType\"}, \"nova::compute::libvirt::virt_type\": {\"get_param\": \"NovaComputeLibvirtType\"}, \"nova::compute::libvirt::enabled_perf_events\": {\"get_param\": \"LibvirtEnabledPerfEvents\"}, \"nova::compute::libvirt::qemu::configure_qemu\": true, \"nova::compute::libvirt::qemu::max_files\": 32768, \"nova::compute::libvirt::qemu::max_processes\": 131072, \"nova::migration::qemu::configure_qemu\": true, \"nova::migration::qemu::migration_port_min\": 61152, \"nova::migration::qemu::migration_port_max\": 61215, \"nova::compute::libvirt::vncserver_listen\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"nova::compute::libvirt::log_filters\": {\"get_param\": \"LibvirtLogFilters\"}, \"nova::compute::libvirt::virtlogd::log_filters\": {\"get_param\": \"LibvirtVirtlogdLogFilters\"}, \"rbd_persistent_storage\": {\"get_param\": \"CinderEnableRbdBackend\"}, \"rbd_disk_cachemodes\": {\"get_param\": \"RbdDiskCachemodes\"}, \"nova::compute::libvirt::virtsecretd::log_filters\": {\"get_param\": \"LibvirtVirtsecretdLogFilters\"}, \"nova::compute::libvirt::virtnodedevd::log_filters\": {\"get_param\": \"LibvirtVirtnodedevdLogFilters\"}, \"nova::compute::libvirt::virtstoraged::log_filters\": {\"get_param\": \"LibvirtVirtstoragedLogFilters\"}, \"nova::compute::libvirt::virtqemud::log_filters\": {\"get_param\": \"LibvirtVirtqemudLogFilters\"}, \"nova::compute::libvirt::virtproxyd::log_filters\": {\"get_param\": \"LibvirtVirtproxydLogFilters\"}, \"tripleo::profile::base::nova::libvirt::modular_libvirt\": true, \"nova::compute::libvirt::services::modular_libvirt\": true, \"nova::compute::libvirt::modular_libvirt\": true, \"nova::migration::libvirt::modular_libvirt\": true}, {\"if\": [\"use_tls_for_live_migration\", {\"tripleo::profile::base::nova::migration::client::libvirt_tls\": true, \"tripleo::profile::base::nova::libvirt::tls_password\": {\"get_param\": [\"LibvirtTLSPassword\"]}, \"nova::compute::libvirt::qemu::default_tls_verify\": {\"get_param\": \"QemuDefaultTLSVerify\"}, \"nova::compute::libvirt::tls_priority\": {\"get_param\": \"LibvirtTLSPriority\"}, \"nova::migration::libvirt::listen_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"nova::migration::libvirt::live_migration_inbound_addr\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}}, {\"nova::migration::libvirt::live_migration_inbound_addr\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}}]}, {\"if\": [\"use_tls_for_vnc\", {\"nova::compute::libvirt::qemu::vnc_tls\": true, \"nova::compute::libvirt::qemu::vnc_tls_verify\": true}]}, {\"if\": [\"use_tls_for_nbd\", {\"nova::compute::libvirt::qemu::nbd_tls\": true, \"nova::migration::libvirt::live_migration_with_native_tls\": true}]}]}, \"puppet_config\": {\"config_volume\": \"nova_libvirt\", \"puppet_tags\": \"libvirtd_config,virtlogd_config,virtproxyd_config,virtqemud_config,virtnodedevd_config,virtsecretd_config,virtstoraged_config,nova_config,file,libvirt_tls_password\", \"step_config\": \"include tripleo::profile::base::nova::libvirt\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_virtlogd.json\": {\"command\": {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"/usr/local/bin/virtlogd_wrapper\", \"/usr/sbin/virtlogd --config /etc/libvirt/virtlogd.conf\"]}, \"config_files\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_permissions\"]}}, \"/var/lib/kolla/config_files/nova_virtsecretd.json\": {\"command\": \"/usr/sbin/virtsecretd --config /etc/libvirt/virtsecretd.conf\", \"config_files\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_permissions\"]}}, \"/var/lib/kolla/config_files/nova_virtnodedevd.json\": {\"command\": \"/usr/sbin/virtnodedevd --config /etc/libvirt/virtnodedevd.conf\", \"config_files\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_permissions\"]}}, \"/var/lib/kolla/config_files/nova_virtstoraged.json\": {\"command\": \"/usr/sbin/virtstoraged --config /etc/libvirt/virtstoraged.conf\", \"config_files\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_permissions\"]}}, \"/var/lib/kolla/config_files/nova_virtqemud.json\": {\"command\": \"/usr/sbin/virtqemud --config /etc/libvirt/virtqemud.conf\", \"config_files\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_permissions\"]}}, \"/var/lib/kolla/config_files/nova_virtproxyd.json\": {\"command\": \"/usr/sbin/virtproxyd --config /etc/libvirt/virtproxyd.conf\", \"config_files\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"NovaLibvirtCommon\", \"kolla_permissions\"]}}}, \"container_config_scripts\": {\"nova_libvirt_init_secret.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_libvirt_init_secret.sh\"}}}, \"docker_config\": {\"step_2\": {\"nova_virtqemud_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"net\": \"none\", \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"user\": \"root\", \"volumes\": [\"/var/log/containers/libvirt/swtpm:/var/log/swtpm:shared,z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R tss:tss /var/log/swtpm\"], \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"create_virtlogd_wrapper\": {\"start_order\": 1, \"detach\": false, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"4\", \"file\", \"include ::tripleo::profile::base::nova::virtlogd_wrapper\"]]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/var/lib/container-config-scripts:/var/lib/container-config-scripts:shared,z\"]]}, \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_3\": {\"map_merge\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, {\"nova_virtlogd_wrapper\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro\"], {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, [\"/var/lib/container-config-scripts/virtlogd_wrapper:/usr/local/bin/virtlogd_wrapper:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"nova_virtlogd\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro\"], {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, [\"/var/lib/container-config-scripts/virtlogd_wrapper:/usr/local/bin/virtlogd_wrapper:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}, {\"nova_virtsecretd\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"pids_limit\": {\"get_param\": \"ContainerNovaLibvirtPidsLimit\"}, \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"depends_on\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_virtlogd.service\"]}], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_opt_volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtsecretd.json:/var/lib/kolla/config_files/config.json:ro\"]]}}}, {\"nova_virtnodedevd\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"pids_limit\": {\"get_param\": \"ContainerNovaLibvirtPidsLimit\"}, \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"depends_on\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_virtlogd.service\"]}], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_opt_volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtnodedevd.json:/var/lib/kolla/config_files/config.json:ro\"]]}}}, {\"nova_virtstoraged\": {\"start_order\": 3, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"pids_limit\": {\"get_param\": \"ContainerNovaLibvirtPidsLimit\"}, \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"depends_on\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_virtlogd.service\"]}], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_opt_volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtstoraged.json:/var/lib/kolla/config_files/config.json:ro\"]]}}}, {\"nova_virtqemud\": {\"start_order\": 4, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"pids_limit\": {\"get_param\": \"ContainerNovaLibvirtPidsLimit\"}, \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"depends_on\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_virtlogd.service\"]}], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_opt_volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtqemud.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/log/containers/libvirt/swtpm:/var/log/swtpm:z\", {\"if\": [{\"get_param\": \"UseCustomGnuTlsQemuCryptoPolicy\"}, \"/etc/crypto-policies:/etc/crypto-policies:ro\"]}]]}}}, {\"nova_virtproxyd\": {\"start_order\": 5, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"pids_limit\": {\"get_param\": \"ContainerNovaLibvirtPidsLimit\"}, \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"depends_on\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_virtlogd.service\"]}], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtCommon\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_opt_volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtproxyd.json:/var/lib/kolla/config_files/config.json:ro\"]]}}}]}, \"step_4\": {\"if\": [\"need_libvirt_secret\", {\"nova_libvirt_init_secret\": {\"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"security_opt\": [\"label=disable\"], \"privileged\": false, \"user\": \"root\", \"cgroupns\": \"host\", \"net\": \"host\", \"environment\": {\"LIBVIRT_DEFAULT_URI\": \"qemu:///system\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/nova_libvirt/etc/nova:/etc/nova\", \"/etc/libvirt:/etc/libvirt\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/libvirt:/var/lib/libvirt:shared\", \"/var/lib/container-config-scripts/nova_libvirt_init_secret.sh:/nova_libvirt_init_secret.sh:ro\", {\"str_replace\": {\"template\": \"HOST_CEPH:/etc/ceph:ro\", \"params\": {\"HOST_CEPH\": {\"get_param\": \"CephConfigPath\"}}}}]]}, \"command\": {\"list_join\": [\" \", [{\"str_replace\": {\"template\": \"/nova_libvirt_init_secret.sh CLUSTER:USER\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}], {\"repeat\": {\"template\": \"<%ceph_info%>\", \"for_each\": {\"<%ceph_info%>\": {\"yaql\": {\"expression\": \"let(u => $.data.default_user) -> $.data.multiconfig.values().select($.CephClusterName + \\\":\\\" + $.get(\\\"CephClientUserName\\\", $u))\", \"data\": {\"default_user\": {\"get_param\": \"CephClientUserName\"}, \"multiconfig\": {\"get_param\": \"CinderRbdMultiConfig\"}}}}}}}]}}}]}}, \"deploy_steps_tasks\": {\"list_concat\": [[{\"name\": \"Ensure recovery of containerized virtqemud\", \"when\": \"step|int == 4\", \"become\": true, \"block\": [{\"name\": \"Create virtqemud recovery script\", \"copy\": {\"dest\": \"/usr/libexec/recover_tripleo_nova_virtqemud.sh\", \"mode\": \"0755\", \"content\": \"#!/bin/bash\\npgrep -f /sbin/virtqemud\\n[ $? -eq 0 ] && exit 0\\nkill -9 $(cat /run/nova_virtqemud.pid)\\n\"}}, {\"name\": \"Create virtqemud recovery trigger service\", \"copy\": {\"dest\": \"/etc/systemd/system/tripleo_nova_virtqemud_recover.service\", \"mode\": \"0644\", \"content\": \"[Unit]\\nDescription=Check and recover tripleo_nova_virtqemud\\nAfter=tripleo_nova_virtqemud.service\\nRequisite=tripleo_nova_virtqemud.service\\n[Service]\\nType=oneshot\\nExecStart=bash /usr/libexec/recover_tripleo_nova_virtqemud.sh\\nSyslogIdentifier=recover_tripleo_nova_virtqemud\\n[Install]\\nWantedBy=multi-user.target\\n\"}}, {\"name\": \"Create virtqemud recovery trigger timer\", \"copy\": {\"dest\": \"/etc/systemd/system/tripleo_nova_virtqemud_recover.timer\", \"mode\": \"0644\", \"content\": \"[Unit]\\nDescription=Check and recover tripleo_nova_virtqemud every 10m\\nPartOf=tripleo_nova_virtqemud.service\\n[Timer]\\nOnCalendar=*:5/10\\nOnActiveSec=120\\nOnUnitActiveSec=60\\nRandomizedDelaySec=1m\\n[Install]\\nWantedBy=timers.target\\n\"}}, {\"name\": \"Enable virtqemud recovery trigger service\", \"systemd\": {\"name\": \"tripleo_nova_virtqemud_recover.service\", \"enabled\": true, \"daemon_reload\": true}}, {\"name\": \"Enable virtqemud recovery trigger timer\", \"systemd\": {\"name\": \"tripleo_nova_virtqemud_recover.timer\", \"enabled\": true, \"state\": \"restarted\", \"daemon_reload\": true}, \"register\": \"virtqemud_recover_timer_result\"}, {\"name\": \"Really enable virtqemud recovery trigger timer\", \"shell\": {\"cmd\": \"systemctl enable --now tripleo_nova_virtqemud_recover.timer\"}, \"when\": \"virtqemud_recover_timer_result.status.UnitFileState != \\\"enabled\\\"\"}]}], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"name\": \"Certificate generation\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Create dirs for certificates and keys\", \"file\": {\"path\": \"{{ item }}\", \"state\": \"directory\", \"serole\": \"object_r\", \"setype\": \"cert_t\", \"seuser\": \"system_u\"}, \"with_items\": [\"/etc/pki/libvirt\", \"/etc/pki/libvirt/private\", \"/etc/pki/qemu\"]}, {\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"libvirt-server-cert\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"libvirt/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": {\"str_replace\": {\"template\": \"# Copy cert and key to libvirt dirs\\ncp CACERT /etc/pki/CA/cacert.pem\\nchown root:root /etc/pki/CA/cacert.pem\\nchmod 644 /etc/pki/CA/cacert.pem\\ncp /etc/pki/tls/certs/libvirt-server-cert.crt /etc/pki/libvirt/servercert.pem\\ncp /etc/pki/tls/private/libvirt-server-cert.key /etc/pki/libvirt/private/serverkey.pem\\npodman exec nova_virtproxyd virt-admin server-update-tls virtproxyd || systemctl reload tripleo_nova_virtproxyd\\n\", \"params\": {\"CACERT\": {\"if\": [\"libvirt_specific_ca_set\", {\"get_param\": \"LibvirtCACert\"}, {\"get_param\": \"InternalTLSCAFile\"}]}}}}, \"key_size\": {\"if\": [\"key_size_libvirt_override_set\", {\"get_param\": \"LibvirtCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, {\"name\": \"libvirt-client-cert\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"libvirt/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": \"# Copy cert and key to libvirt dirs\\ncp /etc/pki/tls/certs/libvirt-client-cert.crt /etc/pki/libvirt/clientcert.pem\\ncp /etc/pki/tls/private/libvirt-client-cert.key /etc/pki/libvirt/private/clientkey.pem\\npodman exec nova_virtproxyd virt-admin server-update-tls virtproxyd || systemctl reload tripleo_nova_virtproxyd\\n\", \"key_size\": {\"if\": [\"key_size_libvirt_override_set\", {\"get_param\": \"LibvirtCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, {\"name\": \"qemu-server-cert\", \"owner\": \"root\", \"group\": \"qemu\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"qemu/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": {\"str_replace\": {\"template\": \"# Copy cert and key to qemu dir\\ncp CACERT /etc/pki/qemu/ca-cert.pem\\nchown root:root /etc/pki/qemu/ca-cert.pem\\nchmod 644 /etc/pki/qemu/ca-cert.pem\\ncp -a /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/server-cert.pem\\ncp -a /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/server-key.pem\\nchgrp qemu /etc/pki/qemu/server-*\\nchmod 0640 /etc/pki/qemu/server-cert.pem\\nchmod 0640 /etc/pki/qemu/server-key.pem\\n\", \"params\": {\"CACERT\": {\"if\": [\"qemu_specific_ca_set\", {\"get_param\": \"QemuCACert\"}, {\"get_param\": \"InternalTLSCAFile\"}]}}}}, \"key_size\": {\"if\": [\"key_size_qemu_server_override_set\", {\"get_param\": \"QemuServerCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, {\"name\": \"qemu-client-cert\", \"owner\": \"root\", \"group\": \"qemu\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"qemu/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": \"# Copy cert and key to qemu dir\\ncp -a /etc/pki/tls/certs/qemu-client-cert.crt /etc/pki/qemu/client-cert.pem\\ncp -a /etc/pki/tls/private/qemu-client-cert.key /etc/pki/qemu/client-key.pem\\nchgrp qemu /etc/pki/qemu/client-*\\nchmod 0640 /etc/pki/qemu/client-cert.pem\\nchmod 0640 /etc/pki/qemu/client-key.pem\\n\", \"key_size\": {\"if\": [\"key_size_qemu_client_override_set\", {\"get_param\": \"QemuClientCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}]]}, [{\"name\": \"Set up systemd target for libvirt services\", \"when\": \"step|int == 4\", \"block\": [{\"name\": \"Create systemd file\", \"copy\": {\"dest\": \"/etc/systemd/system/tripleo_nova_libvirt.target\", \"mode\": \"0644\", \"owner\": \"root\", \"group\": \"root\", \"content\": \"[Unit]\\nWants=tripleo_nova_virtsecretd.service\\nWants=tripleo_nova_virtnodedevd.service\\nWants=tripleo_nova_virtstoraged.service\\nWants=tripleo_nova_virtproxyd.service\\nWants=tripleo_nova_virtqemud.service\\nAfter=tripleo_nova_virtsecretd.service\\nAfter=tripleo_nova_virtnodedevd.service\\nAfter=tripleo_nova_virtstoraged.service\\nAfter=tripleo_nova_virtproxyd.service\\nAfter=tripleo_nova_virtqemud.service\\n\"}, \"become\": true, \"register\": \"libvirt_target_result\"}, {\"name\": \"Reload systemd\", \"systemd\": {\"name\": \"tripleo_nova_libvirt.target\", \"enabled\": true, \"state\": \"restarted\", \"daemon_reload\": true}, \"become\": true, \"when\": \"libvirt_target_result.changed\"}]}]]}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLibvirtLogging\", \"host_prep_tasks\"]}, [{\"name\": \"create libvirt persistent data directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype | default(omit) }}\", \"mode\": \"{{ item.mode | default(omit) }}\"}, \"with_items\": [{\"path\": \"/etc/libvirt\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/libvirt/secrets\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/libvirt/qemu\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/libvirt\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/cache/libvirt\"}, {\"path\": \"/var/lib/nova\", \"setype\": \"container_file_t\"}, {\"path\": \"/run/libvirt\"}, {\"path\": \"/var/log/containers/libvirt/swtpm\", \"setype\": \"container_file_t\", \"mode\": \"0770\"}]}, {\"name\": \"ensure qemu group is present on the host\", \"group\": {\"name\": \"qemu\", \"gid\": 107, \"state\": \"present\"}}, {\"name\": \"ensure qemu user is present on the host\", \"user\": {\"name\": \"qemu\", \"uid\": 107, \"group\": \"qemu\", \"state\": \"present\", \"shell\": \"/sbin/nologin\", \"comment\": \"qemu user\"}}, {\"name\": \"create directory for vhost-user sockets with qemu ownership\", \"file\": {\"path\": \"/var/lib/vhost_sockets\", \"state\": \"directory\", \"owner\": \"qemu\", \"group\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"vhostuser_socket_group\"]}, \"setype\": \"virt_cache_t\", \"seuser\": \"system_u\"}}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}, {\"name\": \"check if libvirt is installed\", \"command\": \"/usr/bin/rpm -q libvirt-daemon\", \"failed_when\": false, \"register\": \"libvirt_installed\", \"check_mode\": false}, {\"name\": \"make sure libvirt services are disabled and masked\", \"service\": {\"name\": \"{{ item }}\", \"state\": \"stopped\", \"enabled\": false, \"masked\": true, \"daemon_reload\": true}, \"with_items\": [\"libvirtd.service\", \"virtlogd.socket\"], \"when\": \"libvirt_installed.rc == 0\"}, {\"name\": \"ensure /run/libvirt is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-libvirt.conf\", \"content\": \"d /run/libvirt 0755 root root - -\\n\"}}, {\"name\": \"Enable os_enable_vtpm SELinux boolean for vTPM\", \"seboolean\": {\"name\": \"os_enable_vtpm\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}, {\"if\": [{\"get_param\": \"UseCustomGnuTlsQemuCryptoPolicy\"}, [{\"name\": \"set gnutls_qemu_config_crypto_policy fact\", \"set_fact\": {\"gnutls_qemu_config_crypto_policy\": {\"get_param\": \"CustomGnuTlsQemuCryptoPolicy\"}}}, {\"name\": \"create gnutls-qemu.config\", \"copy\": {\"dest\": \"/etc/crypto-policies/local.d/gnutls-qemu.config\", \"mode\": \"0644\", \"owner\": \"root\", \"group\": \"root\", \"content\": \"{{ gnutls_qemu_config_crypto_policy }}\\n\"}, \"register\": \"update_gnutls_config\"}], [{\"name\": \"remove gnutls-qemu.config\", \"file\": {\"path\": \"/etc/crypto-policies/local.d/gnutls-qemu.config\", \"state\": \"absent\"}, \"register\": \"update_gnutls_config\"}]]}, {\"name\": \"update crypto policies\", \"command\": \"update-crypto-policies\", \"when\": \"update_gnutls_config.changed\"}]]}, \"metadata_settings\": {\"list_concat\": [{\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"service\": \"libvirt\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}, {\"service\": \"qemu\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}, {\"service\": \"libvirt-vnc\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}]]}]}, \"upgrade_tasks\": {\"list_concat\": [[{\"name\": \"Fail if we are on RHEL8 as this is monolithic libvirt deployment\", \"when\": [\"step|int == 0\", \"'system_upgrade' not in ansible_run_tags\", \"ansible_facts['distribution_major_version'] is version('8', '==')\"], \"fail\": {\"msg\": \"Use of the Modular Libvirt deployment on RHEL8 results in loss of workloads. Use NovaLibvirtLegacy in roles data.\"}}, {\"name\": \"nova_libvirt_container_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-libvirt.conf\", \"state\": \"absent\"}}]}, {\"name\": \"Get container virtlogd image\", \"when\": \"step|int == 1\", \"tags\": \"always\", \"set_fact\": {\"virtlogd_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}}}, {\"name\": \"Force pull image novalibvirt\", \"when\": [\"step|int == 1\"], \"containers.podman.podman_image\": {\"name\": \"{{ virtlogd_image }}\", \"force\": true}}, {\"name\": \"Diff OS release in container image and baremetal\", \"when\": \"step|int == 1\", \"shell\": \"diff /etc/redhat-release <(podman run {{ virtlogd_image }} cat /etc/redhat-release)\\n\", \"args\": {\"executable\": \"/bin/bash\"}, \"failed_when\": false, \"register\": \"libvirt_ubi_diff\"}, {\"name\": \"Fail if UBI of the container does not match RHEL of running host\", \"when\": [\"'system_upgrade' not in ansible_run_tags\", \"step|int == 1\", \"libvirt_ubi_diff.rc == 1\"], \"fail\": {\"msg\": \"The host operating system versus container UBI does not match.\\n{{ libvirt_ubi_diff.stdout }}\\nMost likely container passed to NovaLibvirt was EL8 one.\\nYou have to pass the correct container for container-image-prepare.\\nIf you would continue all running workloads would get destroyed.\\n\"}}], {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, [{\"name\": \"Switch virtlogd image before system upgrade\", \"when\": \"step|int == 1\", \"tags\": [\"never\", \"system_upgrade\"], \"block\": [{\"name\": \"Get running image version\", \"shell\": \"podman ps --filter name=^nova_virtlogd$ --format \\\"{% raw %}{{ .Image }}{% endraw %}\\\"\\n\", \"register\": \"old_virtlogd_image\"}, {\"name\": \"Switch running image to new image in wrapper script\", \"shell\": \"set -o pipefail\\nsed -i -e 's|{{ old_virtlogd_image.stdout }}|{{ virtlogd_image }}|' /var/lib/container-config-scripts/virtlogd_wrapper\\n\", \"when\": [\"old_virtlogd_image.stdout != virtlogd_image\", \"old_virtlogd_image.stdout != ''\"]}]}]]}]}, \"update_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLibvirtCommon\", \"update_tasks\"]}, [{\"name\": \"nova_libvirt_container_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-libvirt.conf\", \"state\": \"absent\"}}]}]]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/deprecated/nova/nova-libvirt-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Libvirt Service\\n\", \"parameters\": {\"ContainerNovaLibvirtImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaLibvirtConfigImage\": {\"description\": \"The container image to use for the nova_libvirt config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaLibvirtUlimit\": {\"default\": [\"nofile=131072\", \"nproc=126960\"], \"description\": \"ulimit for Nova Libvirt Container\", \"type\": \"comma_delimited_list\"}, \"ContainerNovaLibvirtPidsLimit\": {\"default\": 65536, \"description\": \"Tune nova_libvirt container PID limit (set to 0 for unlimited) (defaults to 65536)\", \"type\": \"number\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"UseTLSTransportForLiveMigration\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will set the libvirt URI's transport to tls and configure the relevant keys for libvirt.\"}, \"NovaEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable the Rbd backend for Nova ephemeral storage.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"CinderEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable or not the Rbd backend for Cinder\", \"type\": \"boolean\"}, \"CephClientKey\": {\"description\": \"The Ceph client key. Can be created with ceph-authtool --gen-print-key.\", \"type\": \"string\", \"hidden\": true, \"constraints\": [{\"allowed_pattern\": \"^[a-zA-Z0-9+/]{38}==$\"}]}, \"CephClusterFSID\": {\"type\": \"string\", \"description\": \"The Ceph cluster FSID. Must be a UUID.\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CinderRbdMultiConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring multiple RBD backends. The\\nhash key is the backend name, and the value is a dictionary of parameter\\nvalues unique to that backend. The following parameters are required,\\nand must match the corresponding value defined in CephExternalMultiConfig.\\n  CephClusterName (must match the CephExternalMultiConfig entry's 'cluster')\\n  CephClusterFSID (must match the CephExternalMultiConfig entry's 'fsid')\\nThe following parameters are optional, and override the corresponding\\nparameter's default value.\\n  CephClientUserName\\n  CinderRbdPoolName\\n  CinderRbdExtraPools\\n  CinderRbdAvailabilityZone\\n  CinderRbdFlattenVolumeFromSnapshot\\n\"}, \"UseTLSTransportForVnc\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will enable TLS transaport for libvirt VNC and configure the relevant keys for libvirt.\"}, \"UseTLSTransportForNbd\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will enable TLS transaport for libvirt NBD and configure the relevant keys for libvirt.\"}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"LibvirtCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"QemuServerCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"QemuClientCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"LibvirtCACert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"This specifies the CA certificate to use for TLS in libvirt. This file will be symlinked to the default CA path in libvirt, which is /etc/pki/CA/cacert.pem. Note that due to limitations GNU TLS, which is the TLS backend for libvirt, the file must be less than 65K (so we can't use the system's CA bundle). This parameter should be used if the default (which comes from the InternalTLSCAFile parameter) is not desired. The current default reflects TripleO's default CA, which is FreeIPA. It will only be used if internal TLS is enabled.\"}, \"QemuCACert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"This specifies the CA certificate to use for qemu. This file will be symlinked to the default CA path, which is /etc/pki/qemu/ca-cert.pem. This parameter should be used if the default (which comes from the InternalTLSCAFile parameter) is not desired. The current default reflects TripleO's default CA, which is FreeIPA. It will only be used if internal TLS is enabled.\"}, \"VhostuserSocketGroup\": {\"default\": \"qemu\", \"description\": \"The vhost-user socket directory group name. Defaults to 'qemu'. When vhostuser mode is 'dpdkvhostuserclient' (which is the default mode), the vhost socket is created by qemu.\\n\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"QemuMemoryBackingDir\": {\"type\": \"string\", \"description\": \"Directory used for memoryBacking source if configured as file. NOTE: big files will be stored here\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NovaComputeLibvirtType\": {\"type\": \"string\", \"default\": \"kvm\"}, \"LibvirtEnabledPerfEvents\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"This is a performance event list which could be used as monitor. For example - ``enabled_perf_events = cmt, mbml, mbmt`` The supported events list can be found in https://libvirt.org/html/libvirt-libvirt-domain.html , which you may need to search key words ``VIR_PERF_PARAM_*``\"}, \"MonitoringSubscriptionNovaLibvirt\": {\"default\": \"overcloud-nova-libvirt\", \"type\": \"string\"}, \"MigrationSshKey\": {\"type\": \"json\", \"description\": \"SSH key for migration. Expects a dictionary with keys 'public_key' and 'private_key'. Values should be identical to SSH public/private key files.\\n\", \"default\": {\"public_key\": \"\", \"private_key\": \"\"}}, \"MigrationSshPort\": {\"default\": 2022, \"description\": \"Target port for migration over ssh\", \"type\": \"number\"}, \"LibvirtTLSPassword\": {\"description\": \"The password for the libvirt service when TLS is enabled\", \"type\": \"string\", \"hidden\": true}, \"QemuDefaultTLSVerify\": {\"description\": \"Whether to enable or disable TLS client certificate verification. Enabling this option will reject any client who does not have a certificate signed by the CA in /etc/pki/qemu/ca-cert.pem\\n\", \"default\": true, \"type\": \"boolean\"}, \"LibvirtLogFilters\": {\"description\": \"Defines a filter in libvirt daemon to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:libvirt 1:qemu 1:conf 1:security 3:event 3:json 3:file 3:object 1:util\"}, \"LibvirtVirtlogdLogFilters\": {\"description\": \"Defines a filter in virtlogd to select a different logging level for a given category log outputs, as specified in https://libvirt.org/logging.html .\", \"type\": \"string\", \"default\": \"1:logging 4:object 4:json 4:event 1:util\"}, \"LibvirtTLSPriority\": {\"description\": \"Override the compile time default TLS priority string.\\n\", \"type\": \"string\", \"default\": \"NORMAL:-VERS-SSL3.0:-VERS-TLS-ALL:+VERS-TLS1.2\"}, \"NovaLibvirtOptVolumes\": {\"default\": [], \"description\": \"list of optional volumes to be mounted\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"NovaEnableVirtlogdContainerWrapper\": {\"description\": \"Generate a virtlogd wrapper script so that virtlogd launches in a separate container and won't get restarted e.g. on minor updates.\", \"type\": \"boolean\", \"default\": true}, \"VirtlogdWrapperDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Controls debugging for the wrapper scripts.\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"RbdDiskCachemodes\": {\"type\": \"comma_delimited_list\", \"default\": [\"network=writeback\"], \"description\": \"Disk cachemodes for RBD backend.\\n\"}}, \"conditions\": {\"use_tls_for_live_migration\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForLiveMigration\"}]}, \"libvirt_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtCACert\"}, \"\"]}}, \"need_libvirt_secret\": {\"or\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaEnableRbdBackend\"]}, true]}, {\"and\": [{\"equals\": [{\"get_param\": [\"RoleParameters\", \"NovaEnableRbdBackend\"]}, \"\"]}, {\"get_param\": \"NovaEnableRbdBackend\"}]}, {\"get_param\": \"CinderEnableRbdBackend\"}]}, \"use_tls_for_vnc\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForVnc\"}]}, \"libvirt_vnc_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtVncCACert\"}, \"\"]}}, \"memory_backing_dir_set\": {\"not\": {\"and\": [{\"equals\": [{\"get_param\": \"QemuMemoryBackingDir\"}, \"\"]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"QemuMemoryBackingDir\"]}, \"\"]}]}}, \"use_tls_for_nbd\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForNbd\"}]}, \"qemu_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"QemuCACert\"}, \"\"]}}, \"key_size_libvirt_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtCertificateKeySize\"}, \"\"]}}, \"key_size_qemu_client_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"QemuClientCertificateKeySize\"}, \"\"]}}, \"key_size_qemu_server_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"QemuServerCertificateKeySize\"}, \"\"]}}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"vhostuser_socket_group\": \"VhostuserSocketGroup\", \"nova::compute::libvirt::qemu::memory_backing_dir\": \"QemuMemoryBackingDir\", \"nova_libvirt_opt_volumes\": \"NovaLibvirtOptVolumes\", \"ContainerNovaLibvirtImage\": \"ContainerNovaLibvirtImage\", \"ContainerNovaLibvirtConfigImage\": \"ContainerNovaLibvirtConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"VhostuserSocketGroup\": {\"get_param\": \"VhostuserSocketGroup\"}, \"QemuMemoryBackingDir\": {\"get_param\": \"QemuMemoryBackingDir\"}, \"NovaLibvirtOptVolumes\": {\"get_param\": \"NovaLibvirtOptVolumes\"}, \"ContainerNovaLibvirtImage\": {\"get_param\": \"ContainerNovaLibvirtImage\"}, \"ContainerNovaLibvirtConfigImage\": {\"get_param\": \"ContainerNovaLibvirtConfigImage\"}}}]}}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"NovaLibvirtLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaLibvirt\"}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaLibvirtCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-libvirt-common.yaml\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Libvirt service.\", \"value\": {\"service_name\": \"nova_libvirt\", \"firewall_rules\": {\"200 nova_libvirt\": {\"dport\": [16514, \"61152-61215\", \"5900-6923\"]}}, \"ansible_group_vars\": {\"tripleo_nova_libvirt_virsh_container\": \"nova_libvirt\"}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaLibvirt\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"config_settings\"]}, {\"nova::compute::libvirt::manage_libvirt_services\": false, \"tripleo::profile::base::nova::virtlogd_wrapper::enable_wrapper\": {\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo::profile::base::nova::virtlogd_wrapper::virtlogd_process_wrapper\": \"/var/lib/container-config-scripts/virtlogd_wrapper\", \"tripleo::profile::base::nova::virtlogd_wrapper::virtlogd_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"tripleo::profile::base::nova::virtlogd_wrapper::debug\": {\"if\": [{\"get_param\": \"VirtlogdWrapperDebug\"}, true, {\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\", \"nova::logging::debug\"]}]}, \"nova::compute::libvirt::migration_support\": false, \"nova::compute::rbd::libvirt_images_rbd_ceph_conf\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"nova::compute::rbd::libvirt_rbd_user\": {\"get_param\": \"CephClientUserName\"}, \"tripleo::profile::base::nova::compute_libvirt_shared::nova_rbd_ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"nova::compute::rbd::rbd_keyring\": {\"list_join\": [\".\", [\"client\", {\"get_param\": \"CephClientUserName\"}]]}, \"nova::compute::rbd::libvirt_rbd_secret_key\": {\"get_param\": \"CephClientKey\"}, \"nova::compute::rbd::libvirt_rbd_secret_uuid\": {\"get_param\": \"CephClusterFSID\"}, \"tripleo::profile::base::nova::migration::client::libvirt_enabled\": true, \"tripleo::profile::base::nova::migration::client::ssh_private_key\": {\"get_param\": [\"MigrationSshKey\", \"private_key\"]}, \"tripleo::profile::base::nova::migration::client::ssh_port\": {\"get_param\": \"MigrationSshPort\"}, \"nova::compute::libvirt::services::libvirt_virt_type\": {\"get_param\": \"NovaComputeLibvirtType\"}, \"nova::compute::libvirt::virt_type\": {\"get_param\": \"NovaComputeLibvirtType\"}, \"nova::compute::libvirt::enabled_perf_events\": {\"get_param\": \"LibvirtEnabledPerfEvents\"}, \"nova::compute::libvirt::qemu::configure_qemu\": true, \"nova::compute::libvirt::qemu::max_files\": 32768, \"nova::compute::libvirt::qemu::max_processes\": 131072, \"nova::migration::qemu::configure_qemu\": true, \"nova::migration::qemu::migration_port_min\": 61152, \"nova::migration::qemu::migration_port_max\": 61215, \"nova::compute::libvirt::vncserver_listen\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"nova::compute::libvirt::log_filters\": {\"get_param\": \"LibvirtLogFilters\"}, \"nova::compute::libvirt::virtlogd::log_filters\": {\"get_param\": \"LibvirtVirtlogdLogFilters\"}, \"rbd_persistent_storage\": {\"get_param\": \"CinderEnableRbdBackend\"}, \"rbd_disk_cachemodes\": {\"get_param\": \"RbdDiskCachemodes\"}, \"tripleo::profile::base::nova::libvirt::modular_libvirt\": false, \"nova::compute::libvirt::services::modular_libvirt\": false, \"nova::compute::libvirt::modular_libvirt\": false, \"nova::migration::libvirt::modular_libvirt\": false}, {\"if\": [\"use_tls_for_live_migration\", {\"tripleo::profile::base::nova::migration::client::libvirt_tls\": true, \"tripleo::profile::base::nova::libvirt::tls_password\": {\"get_param\": [\"LibvirtTLSPassword\"]}, \"nova::compute::libvirt::qemu::default_tls_verify\": {\"get_param\": \"QemuDefaultTLSVerify\"}, \"nova::compute::libvirt::tls_priority\": {\"get_param\": \"LibvirtTLSPriority\"}, \"nova::migration::libvirt::listen_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"nova::migration::libvirt::live_migration_inbound_addr\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}}, {\"nova::migration::libvirt::live_migration_inbound_addr\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}}]}, {\"if\": [\"use_tls_for_vnc\", {\"nova::compute::libvirt::qemu::vnc_tls\": true, \"nova::compute::libvirt::qemu::vnc_tls_verify\": true}]}, {\"if\": [\"use_tls_for_nbd\", {\"nova::compute::libvirt::qemu::nbd_tls\": true, \"nova::migration::libvirt::live_migration_with_native_tls\": true}]}]}, \"puppet_config\": {\"config_volume\": \"nova_libvirt\", \"puppet_tags\": \"libvirtd_config,virtlogd_config,nova_config,file,libvirt_tls_password\", \"step_config\": \"include tripleo::profile::base::nova::libvirt\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_libvirt.json\": {\"command\": \"/nova_libvirt_launcher.sh\", \"config_files\": {\"list_concat\": [[{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}]]}, \"permissions\": {\"list_concat\": [[{\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"nova:nova\", \"perm\": \"0600\"}], {\"repeat\": {\"template\": {\"path\": \"/etc/ceph/<%keyring%>\", \"owner\": \"nova:nova\", \"perm\": \"0600\"}, \"for_each\": {\"<%keyring%>\": {\"yaql\": {\"expression\": \"let(u => $.data.default_user) -> $.data.multiconfig.values().select($.CephClusterName + \\\".client.\\\" +  $.get(\\\"CephClientUserName\\\", $u) + \\\".keyring\\\")\", \"data\": {\"default_user\": {\"get_param\": \"CephClientUserName\"}, \"multiconfig\": {\"get_param\": \"CinderRbdMultiConfig\"}}}}}}}]}}, \"/var/lib/kolla/config_files/nova_virtlogd.json\": {\"command\": {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"/usr/local/bin/virtlogd_wrapper\", \"/usr/sbin/virtlogd --config /etc/libvirt/virtlogd.conf\"]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"container_config_scripts\": {\"nova_libvirt_launcher.sh\": {\"mode\": \"0755\", \"content\": {\"str_replace\": {\"template\": \"#!/bin/bash\\nset -xe\\nif [[ -f /usr/lib/systemd/kvm-setup ]]; then\\n  /usr/lib/systemd/kvm-setup\\nfi\\nexec systemd-run --scope --slice=system --property=Delegate=\\\"cpu cpuacct memory blkio devices\\\" /usr/sbin/libvirtd LIBVIRTD_ARGS\\n\", \"params\": {\"LIBVIRTD_ARGS\": {\"if\": [\"use_tls_for_live_migration\", \"--listen\", \"\"]}}}}}, \"nova_libvirt_init_secret.sh\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/nova_libvirt_init_secret.sh\"}}}, \"docker_config\": {\"step_2\": {\"create_virtlogd_wrapper\": {\"start_order\": 1, \"detach\": false, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"4\", \"file\", \"include ::tripleo::profile::base::nova::virtlogd_wrapper\"]]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/var/lib/container-config-scripts:/var/lib/container-config-scripts:shared,z\"]]}, \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_3\": {\"map_merge\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, {\"nova_virtlogd_wrapper\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck virtlogd\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", \"/lib/modules:/lib/modules:ro\", \"/dev:/dev\", \"/run:/run\", \"/sys/fs/cgroup:/sys/fs/cgroup\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/libvirt:/var/lib/libvirt\", \"/etc/libvirt/qemu:/etc/libvirt/qemu:ro\", \"/var/lib/nova:/var/lib/nova:shared\"], {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, [\"/var/lib/container-config-scripts/virtlogd_wrapper:/usr/local/bin/virtlogd_wrapper:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"nova_virtlogd\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck virtlogd\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_virtlogd.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", \"/lib/modules:/lib/modules:ro\", \"/dev:/dev\", \"/run:/run\", \"/sys/fs/cgroup:/sys/fs/cgroup\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/libvirt:/var/lib/libvirt\", \"/etc/libvirt/qemu:/etc/libvirt/qemu:ro\", \"/var/lib/nova:/var/lib/nova:shared\"], {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, [\"/var/lib/container-config-scripts/virtlogd_wrapper:/usr/local/bin/virtlogd_wrapper:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}, {\"nova_libvirt\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"ulimit\": {\"get_param\": \"ContainerNovaLibvirtUlimit\"}, \"cgroupns\": \"host\", \"net\": \"host\", \"pid\": \"host\", \"pids_limit\": {\"get_param\": \"ContainerNovaLibvirtPidsLimit\"}, \"privileged\": true, \"security_opt\": [\"label=level:s0\", \"label=type:spc_t\", \"label=filetype:container_file_t\"], \"restart\": \"always\", \"depends_on\": [{\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_virtlogd.service\"]}], \"healthcheck\": {\"test\": \"/openstack/healthcheck libvirtd\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLibvirtLogging\", \"volumes\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nova_libvirt_opt_volumes\"]}, [\"/etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro\", \"/var/lib/kolla/config_files/nova_libvirt.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", \"/var/lib/container-config-scripts/nova_libvirt_launcher.sh:/nova_libvirt_launcher.sh:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"ro\"]]}, \"/lib/modules:/lib/modules:ro\", \"/dev:/dev\", \"/run:/run\", \"/sys/fs/cgroup:/sys/fs/cgroup\", \"/etc/libvirt:/etc/libvirt\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/libvirt:/var/lib/libvirt:shared\", \"/var/cache/libvirt:/var/cache/libvirt:shared\", \"/var/lib/vhost_sockets:/var/lib/vhost_sockets\", \"/var/lib/nova:/var/lib/nova:shared\", \"/sys/fs/selinux:/sys/fs/selinux\", \"/etc/selinux/config:/etc/selinux/config:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/CA/cacert.pem:/etc/pki/CA/cacert.pem:ro\", \"/etc/pki/libvirt:/etc/pki/libvirt:ro\", \"/etc/pki/qemu:/etc/pki/qemu:ro\"]]}, {\"if\": [\"memory_backing_dir_set\", [{\"str_replace\": {\"template\": \"MEMORY_BACKING_DIR:MEMORY_BACKING_DIR\", \"params\": {\"MEMORY_BACKING_DIR\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"memory_backing_dir\"]}}}}]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}, \"step_4\": {\"if\": [\"need_libvirt_secret\", {\"nova_libvirt_init_secret\": {\"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}, \"security_opt\": [\"label=disable\"], \"privileged\": false, \"user\": \"root\", \"cgroupns\": \"host\", \"net\": \"host\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/nova_libvirt/etc/nova:/etc/nova\", \"/etc/libvirt:/etc/libvirt\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/libvirt:/var/lib/libvirt:shared\", \"/var/lib/container-config-scripts/nova_libvirt_init_secret.sh:/nova_libvirt_init_secret.sh:ro\", {\"str_replace\": {\"template\": \"HOST_CEPH:/etc/ceph:ro\", \"params\": {\"HOST_CEPH\": {\"get_param\": \"CephConfigPath\"}}}}]]}, \"command\": {\"list_join\": [\" \", [{\"str_replace\": {\"template\": \"/nova_libvirt_init_secret.sh CLUSTER:USER\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}], {\"repeat\": {\"template\": \"<%ceph_info%>\", \"for_each\": {\"<%ceph_info%>\": {\"yaql\": {\"expression\": \"let(u => $.data.default_user) -> $.data.multiconfig.values().select($.CephClusterName + \\\":\\\" + $.get(\\\"CephClientUserName\\\", $u))\", \"data\": {\"default_user\": {\"get_param\": \"CephClientUserName\"}, \"multiconfig\": {\"get_param\": \"CinderRbdMultiConfig\"}}}}}}}]}}}]}}, \"deploy_steps_tasks\": {\"list_concat\": [[{\"name\": \"validate nova-libvirt container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_libvirt\"}, \"register\": \"nova_libvirt_infos\", \"failed_when\": [\"nova_libvirt_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_libvirt_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 4\"]}, {\"name\": \"Set up systemd target for libvirt services\", \"when\": \"step|int == 4\", \"block\": [{\"name\": \"Create systemd file\", \"copy\": {\"dest\": \"/etc/systemd/system/tripleo_nova_libvirt.target\", \"mode\": \"0644\", \"owner\": \"root\", \"group\": \"root\", \"content\": \"[Unit]\\nWants=tripleo_nova_libvirt.service\\nAfter=tripleo_nova_libvirt.service\\n\"}, \"become\": true, \"register\": \"libvirt_target_result\"}, {\"name\": \"Reload systemd\", \"systemd\": {\"name\": \"tripleo_nova_libvirt.target\", \"enabled\": true, \"state\": \"restarted\", \"daemon_reload\": true}, \"become\": true, \"when\": \"libvirt_target_result.changed\"}]}], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"name\": \"Certificate generation\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Create dirs for certificates and keys\", \"file\": {\"path\": \"{{ item }}\", \"state\": \"directory\", \"serole\": \"object_r\", \"setype\": \"cert_t\", \"seuser\": \"system_u\"}, \"with_items\": [\"/etc/pki/libvirt\", \"/etc/pki/libvirt/private\", \"/etc/pki/qemu\"]}, {\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"libvirt-server-cert\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"libvirt/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": {\"str_replace\": {\"template\": \"# Copy cert and key to libvirt dirs\\ncp CACERT /etc/pki/CA/cacert.pem\\nchown root:root /etc/pki/CA/cacert.pem\\nchmod 644 /etc/pki/CA/cacert.pem\\ncp /etc/pki/tls/certs/libvirt-server-cert.crt /etc/pki/libvirt/servercert.pem\\ncp /etc/pki/tls/private/libvirt-server-cert.key /etc/pki/libvirt/private/serverkey.pem\\nsystemctl reload tripleo_nova_libvirt\\n\", \"params\": {\"CACERT\": {\"if\": [\"libvirt_specific_ca_set\", {\"get_param\": \"LibvirtCACert\"}, {\"get_param\": \"InternalTLSCAFile\"}]}}}}, \"key_size\": {\"if\": [\"key_size_libvirt_override_set\", {\"get_param\": \"LibvirtCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, {\"name\": \"libvirt-client-cert\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"libvirt/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": \"# Copy cert and key to libvirt dirs\\ncp /etc/pki/tls/certs/libvirt-client-cert.crt /etc/pki/libvirt/clientcert.pem\\ncp /etc/pki/tls/private/libvirt-client-cert.key /etc/pki/libvirt/private/clientkey.pem\\nsystemctl reload tripleo_nova_libvirt\\n\", \"key_size\": {\"if\": [\"key_size_libvirt_override_set\", {\"get_param\": \"LibvirtCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, {\"name\": \"qemu-server-cert\", \"owner\": \"root\", \"group\": \"qemu\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"qemu/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": {\"str_replace\": {\"template\": \"# Copy cert and key to qemu dir\\ncp CACERT /etc/pki/qemu/ca-cert.pem\\nchown root:root /etc/pki/qemu/ca-cert.pem\\nchmod 644 /etc/pki/qemu/ca-cert.pem\\ncp -a /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/server-cert.pem\\ncp -a /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/server-key.pem\\nchgrp qemu /etc/pki/qemu/server-*\\nchmod 0640 /etc/pki/qemu/server-cert.pem\\nchmod 0640 /etc/pki/qemu/server-key.pem\\nsystemctl reload tripleo_nova_libvirt\\n\", \"params\": {\"CACERT\": {\"if\": [\"qemu_specific_ca_set\", {\"get_param\": \"QemuCACert\"}, {\"get_param\": \"InternalTLSCAFile\"}]}}}}, \"key_size\": {\"if\": [\"key_size_qemu_server_override_set\", {\"get_param\": \"QemuServerCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}, {\"name\": \"qemu-client-cert\", \"owner\": \"root\", \"group\": \"qemu\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"qemu/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"run_after\": \"# Copy cert and key to qemu dir\\ncp -a /etc/pki/tls/certs/qemu-client-cert.crt /etc/pki/qemu/client-cert.pem\\ncp -a /etc/pki/tls/private/qemu-client-cert.key /etc/pki/qemu/client-key.pem\\nchgrp qemu /etc/pki/qemu/client-*\\nchmod 0640 /etc/pki/qemu/client-cert.pem\\nchmod 0640 /etc/pki/qemu/client-key.pem\\nsystemctl reload tripleo_nova_libvirt\\n\", \"key_size\": {\"if\": [\"key_size_qemu_client_override_set\", {\"get_param\": \"QemuClientCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}]]}]}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLibvirtLogging\", \"host_prep_tasks\"]}, [{\"name\": \"create libvirt persistent data directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype | default(omit) }}\"}, \"with_items\": [{\"path\": \"/etc/libvirt\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/libvirt/secrets\", \"setype\": \"container_file_t\"}, {\"path\": \"/etc/libvirt/qemu\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/lib/libvirt\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/cache/libvirt\"}, {\"path\": \"/var/lib/nova\", \"setype\": \"container_file_t\"}, {\"path\": \"/run/libvirt\"}]}, {\"name\": \"ensure qemu group is present on the host\", \"group\": {\"name\": \"qemu\", \"gid\": 107, \"state\": \"present\"}}, {\"name\": \"ensure qemu user is present on the host\", \"user\": {\"name\": \"qemu\", \"uid\": 107, \"group\": \"qemu\", \"state\": \"present\", \"shell\": \"/sbin/nologin\", \"comment\": \"qemu user\"}}, {\"name\": \"create directory for vhost-user sockets with qemu ownership\", \"file\": {\"path\": \"/var/lib/vhost_sockets\", \"state\": \"directory\", \"owner\": \"qemu\", \"group\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"vhostuser_socket_group\"]}, \"setype\": \"virt_cache_t\", \"seuser\": \"system_u\"}}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}, {\"name\": \"check if libvirt is installed\", \"command\": \"/usr/bin/rpm -q libvirt-daemon\", \"failed_when\": false, \"register\": \"libvirt_installed\", \"check_mode\": false}, {\"name\": \"make sure libvirt services are disabled and masked\", \"service\": {\"name\": \"{{ item }}\", \"state\": \"stopped\", \"enabled\": false, \"masked\": true, \"daemon_reload\": true}, \"with_items\": [\"libvirtd.service\", \"virtlogd.socket\"], \"when\": \"libvirt_installed.rc == 0\"}, {\"name\": \"ensure /run/libvirt is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-libvirt.conf\", \"content\": \"d /run/libvirt 0755 root root - -\\n\"}}, {\"name\": \"Enable os_enable_vtpm SELinux boolean for vTPM\", \"seboolean\": {\"name\": \"os_enable_vtpm\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]]}, \"metadata_settings\": {\"list_concat\": [{\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"service\": \"libvirt\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}, {\"service\": \"qemu\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}, {\"service\": \"libvirt-vnc\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}]]}]}, \"upgrade_tasks\": {\"list_concat\": [[{\"name\": \"Fail if we are on RHEL9 as this is monolithic libvirt deployment\", \"when\": [\"step|int == 0\", \"'system_upgrade' not in ansible_run_tags\", \"ansible_facts['distribution_major_version'] is version('9', '==')\"], \"fail\": {\"msg\": \"On RHEL9 use Modular Libvirt deployment. Use NovaLibvirt in roles data.\"}}, {\"name\": \"nova_libvirt_container_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-libvirt.conf\", \"state\": \"absent\"}}]}, {\"name\": \"Get container virtlogd image\", \"when\": \"step|int == 1\", \"tags\": \"always\", \"set_fact\": {\"virtlogd_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtImage\"]}}}, {\"name\": \"Force pull image novalibvirt\", \"when\": [\"step|int == 1\"], \"containers.podman.podman_image\": {\"name\": \"{{ virtlogd_image }}\", \"force\": true}}, {\"name\": \"Diff OS release in container image and baremetal\", \"when\": \"step|int == 1\", \"shell\": \"diff /etc/redhat-release <(podman run {{ virtlogd_image }} cat /etc/redhat-release)\\n\", \"args\": {\"executable\": \"/bin/bash\"}, \"failed_when\": false, \"register\": \"libvirt_ubi_diff\"}, {\"name\": \"Fail if UBI of the container does not match RHEL of running host\", \"when\": [\"'system_upgrade' not in ansible_run_tags\", \"step|int == 1\", \"libvirt_ubi_diff.rc == 1\"], \"fail\": {\"msg\": \"The host operating system versus container UBI does not match.\\n{{ libvirt_ubi_diff.stdout }}\\nMost likely container passed to NovaLibvirtLegacy was EL9 one.\\nYou have to pass the correct container for container-image-prepare.\\nIf you would continue all running workloads would get destroyed.\\n\"}}], {\"if\": [{\"get_param\": \"NovaEnableVirtlogdContainerWrapper\"}, [{\"name\": \"Switch virtlogd image before system upgrade\", \"when\": \"step|int == 1\", \"tags\": [\"never\", \"system_upgrade\"], \"block\": [{\"name\": \"Get running image version\", \"shell\": \"podman ps --filter name=^nova_virtlogd$ --format \\\"{% raw %}{{ .Image }}{% endraw %}\\\"\\n\", \"register\": \"old_virtlogd_image\"}, {\"name\": \"Switch running image to new image in wrapper script\", \"shell\": \"set -o pipefail\\nsed -i -e 's|{{ old_virtlogd_image.stdout }}|{{ virtlogd_image }}|' /var/lib/container-config-scripts/virtlogd_wrapper\\n\", \"when\": [\"old_virtlogd_image.stdout != virtlogd_image\", \"old_virtlogd_image.stdout != ''\"]}]}]]}]}, \"update_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLibvirtCommon\", \"update_tasks\"]}, [{\"name\": \"nova_libvirt_container_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-libvirt.conf\", \"state\": \"absent\"}}]}]]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-libvirt-guests-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configure libvirt-guests\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerNovaLibvirtConfigImage\": {\"description\": \"The container image to use for the nova_libvirt config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaResumeGuestsStateOnHostBoot\": {\"default\": false, \"description\": \"Whether to start running instance on compute host reboot\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NovaResumeGuestsShutdownTimeout\": {\"default\": 300, \"description\": \"Number of seconds we're willing to wait for a guest to shut down. If this is 0, then there is no time out (use with caution, as guests might not respond to a shutdown request). The default value is 300 seconds (5 minutes).\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"tripleo::profile::base::nova::compute::libvirt_guests::enabled\": \"NovaResumeGuestsStateOnHostBoot\", \"nova::compute::libvirt_guests::shutdown_timeout\": \"NovaResumeGuestsShutdownTimeout\", \"ContainerNovaLibvirtConfigImage\": \"ContainerNovaLibvirtConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NovaResumeGuestsStateOnHostBoot\": {\"get_param\": \"NovaResumeGuestsStateOnHostBoot\"}, \"NovaResumeGuestsShutdownTimeout\": {\"get_param\": \"NovaResumeGuestsShutdownTimeout\"}, \"ContainerNovaLibvirtConfigImage\": {\"get_param\": \"ContainerNovaLibvirtConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for libvirt-guests\", \"value\": {\"service_name\": \"nova_libvirt_guests\", \"config_settings\": {\"get_attr\": [\"RoleParametersValue\", \"value\"]}, \"puppet_config\": {\"config_volume\": \"nova_libvirt\", \"puppet_tags\": \"libvirtd_config,nova_config,file,libvirt_tls_password\", \"step_config\": \"include tripleo::profile::base::nova::compute::libvirt_guests\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtConfigImage\"]}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/nova-common.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Template for nova's logging to files\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerNovaImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaServiceName\": {\"description\": \"service name\", \"type\": \"string\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}}, \"resources\": {\"InitLogContainerName\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"string\", \"value\": {\"str_replace\": {\"template\": \"nova_SERVICE_init_log\", \"params\": {\"SERVICE\": {\"get_param\": \"NovaServiceName\"}}}}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaImage\": \"ContainerNovaImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaImage\": {\"get_param\": \"ContainerNovaImage\"}}}]}}}}, \"outputs\": {\"cmd_extra_args\": {\"description\": \"Extra command line arguments for running the service in the container.\", \"value\": \"\"}, \"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/nova:/var/log/nova\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"map_replace\": [{\"CONTAINERNAME\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/nova:/var/log/nova:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R nova:nova /var/log/nova\"], \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, {\"keys\": {\"CONTAINERNAME\": {\"get_attr\": [\"InitLogContainerName\", \"value\"]}}}]}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"setype\": \"{{ item.setype }}\", \"state\": \"directory\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/nova\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-manager-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized nova-manage runner service\\n\", \"parameters\": {\"ContainerNovaConductorImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}}, \"resources\": {\"NovaLogging\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/logging/files/nova-common.yaml\", \"properties\": {\"ContainerNovaImage\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConductorImage\"]}, \"NovaServiceName\": \"manager\"}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"NovaConductorBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-conductor-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"NovaAdditionalCell\": false}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaConductorImage\": \"ContainerNovaConductorImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaConductorImage\": {\"get_param\": \"ContainerNovaConductorImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the nova-manage runner service.\", \"value\": {\"service_name\": \"nova_manager\", \"config_settings\": {\"get_attr\": [\"NovaConductorBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"mysql\": {\"get_attr\": [\"NovaConductorBase\", \"role_data\", \"service_config_settings\", \"mysql\"]}}, \"puppet_config\": {\"get_attr\": [\"NovaConductorBase\", \"role_data\", \"puppet_config\"]}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_manager.json\": {\"command\": \"/bin/sleep infinity\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"NovaLogging\", \"docker_config\", \"step_2\"]}, \"step_4\": {\"nova_manager\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConductorImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_manager.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"get_attr\": [\"NovaLogging\", \"host_prep_tasks\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-metadata-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova Metadata service\\n\", \"parameters\": {\"ContainerNovaMetadataImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaMetadataConfigImage\": {\"description\": \"The container image to use for the nova config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaMetadataLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.nova.api.metadata\", \"file\": \"/var/log/containers/nova/nova-metadata-api.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"NovaWorkers\": {\"default\": 0, \"description\": \"Number of workers for Nova services.\", \"type\": \"number\"}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"NeutronMetadataProxySharedSecret\": {\"description\": \"Shared secret to prevent spoofing\", \"type\": \"string\", \"hidden\": true}, \"MonitoringSubscriptionNovaMetadata\": {\"default\": \"overcloud-nova-metadata\", \"type\": \"string\"}, \"NovaLocalMetadataPerCell\": {\"default\": false, \"description\": \"Indicates that the nova-metadata API service has been deployed per-cell, so that we can have better performance and data isolation in a multi-cell deployment. Users should consider the use of this configuration depending on how neutron is setup. If networks span cells, you might need to run nova-metadata API service globally. If your networks are segmented along cell boundaries, then you can run nova-metadata API service per cell. When running nova-metadata API service per cell, you should also configure each Neutron metadata-agent to point to the corresponding nova-metadata API service.\\n\", \"type\": \"boolean\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}}, \"conditions\": {\"nova_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"NovaWorkers\"}, 0]}}, \"is_neutron_shared_metadata_notempty\": {\"not\": {\"equals\": [{\"get_param\": \"NeutronMetadataProxySharedSecret\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"NovaMetadataLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaMetadata\"}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaApiDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-apidb-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-db-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaMetadataImage\": \"ContainerNovaMetadataImage\", \"ContainerNovaMetadataConfigImage\": \"ContainerNovaMetadataConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaMetadataImage\": {\"get_param\": \"ContainerNovaMetadataImage\"}, \"ContainerNovaMetadataConfigImage\": {\"get_param\": \"ContainerNovaMetadataConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova Metadata service.\", \"value\": {\"service_name\": \"nova_metadata\", \"firewall_rules\": {\"139 nova_metadata\": {\"dport\": [8775]}}, \"firewall_frontend_rules\": {\"100 nova_metadatahaproxy_frontend\": {\"dport\": [8775]}}, \"firewall_ssl_frontend_rules\": {\"100 nova_metadatahaproxy_frontend_ssl\": {\"dport\": [13775]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaMetadata\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"if\": [{\"not\": {\"get_param\": \"NovaLocalMetadataPerCell\"}}, {\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"config_settings\"]}]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaMetadataLogging\", \"config_settings\"]}, {\"apache::default_vhost\": false}, {\"nova::keystone::authtoken::project_name\": \"service\", \"nova::keystone::authtoken::password\": {\"get_param\": \"NovaPassword\"}, \"nova::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"nova::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"nova::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"nova::keystone::authtoken::interface\": \"internal\", \"nova::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"nova::wsgi::apache_metadata::api_port\": \"8775\", \"nova::wsgi::apache_metadata::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"nova::metadata::local_metadata_per_cell\": {\"get_param\": \"NovaLocalMetadataPerCell\"}, \"nova::wsgi::apache_metadata::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}}}}, \"nova::wsgi::apache_metadata::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaMetadataNetwork\"]}}}}, \"nova::wsgi::apache_metadata::workers\": {\"if\": [\"nova_workers_set\", {\"get_param\": \"NovaWorkers\"}]}, \"nova::metadata::neutron_metadata_proxy_shared_secret\": {\"if\": [\"is_neutron_shared_metadata_notempty\", {\"get_param\": \"NeutronMetadataProxySharedSecret\"}]}}]}, \"service_config_settings\": {\"rabbitmq\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"service_config_settings\"], \"rabbitmq\": null}, \"mysql\": {\"map_merge\": [{\"if\": [{\"not\": {\"get_param\": \"NovaLocalMetadataPerCell\"}}, {\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}]}, \"rsyslog\": {\"tripleo_logging_sources_nova_metadata\": [{\"get_param\": \"NovaMetadataLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"nova_metadata\", \"puppet_tags\": \"nova_config,nova_api_paste_ini\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::nova::metadata\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaMetadataConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_metadata.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"NovaMetadataLogging\", \"docker_config\", \"step_2\"]}, \"step_4\": {\"nova_metadata\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaMetadataImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaMetadataLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_metadata.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_metadata:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, [{\"name\": \"validate nova-metadata container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_metadata\"}, \"register\": \"nova_metadata_infos\", \"failed_when\": [\"nova_metadata_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_metadata_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 5\"]}]]}, \"host_prep_tasks\": {\"get_attr\": [\"NovaMetadataLogging\", \"host_prep_tasks\"]}, \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop nova metadata container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"nova_metadata\"], \"tripleo_delegate_to\": \"{{ groups['nova_metadata'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/sshd/sshd-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configure sshd_config\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"BannerText\": {\"default\": \"\", \"description\": \"Configures Banner text in sshd_config\", \"type\": \"string\"}, \"MessageOfTheDay\": {\"default\": \"\", \"description\": \"Configures /etc/motd text\", \"type\": \"string\"}, \"SshServerOptions\": {\"default\": {}, \"description\": \"Mapping of sshd_config values\", \"type\": \"json\"}, \"SshServerOptionsOverrides\": {\"default\": {}, \"description\": \"Mapping of sshd_config values to override definitions in SshServerOptions\", \"type\": \"json\"}, \"PasswordAuthentication\": {\"default\": \"no\", \"description\": \"Whether or not disable password authentication\", \"type\": \"string\"}, \"SshFirewallAllowAll\": {\"default\": false, \"description\": \"Set this to true to open up ssh access from all sources.\", \"type\": \"boolean\"}}, \"conditions\": {\"ssh_firewall_allow_all\": {\"equals\": [{\"get_param\": \"SshFirewallAllowAll\"}, true]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the ssh\", \"value\": {\"service_name\": \"sshd\", \"firewall_rules\": {\"003 accept ssh from all\": {\"proto\": \"tcp\", \"dport\": 22, \"extras\": {\"ensure\": {\"if\": [\"ssh_firewall_allow_all\", \"present\", \"absent\"]}}}}, \"config_settings\": {\"tripleo::profile::base::sshd::bannertext\": {\"get_param\": \"BannerText\"}, \"tripleo::profile::base::sshd::motd\": {\"get_param\": \"MessageOfTheDay\"}, \"tripleo::profile::base::sshd::options\": {\"map_merge\": [{\"get_param\": \"SshServerOptions\"}, {\"get_param\": \"SshServerOptionsOverrides\"}]}, \"tripleo::profile::base::sshd::password_authentication\": {\"get_param\": \"PasswordAuthentication\"}}, \"step_config\": \"include tripleo::profile::base::sshd\"}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-migration-target-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova Migration Target service\\n\", \"parameters\": {\"ContainerNovaComputeImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaLibvirtConfigImage\": {\"description\": \"The container image to use for the nova_libvirt config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"DockerNovaMigrationSshdPort\": {\"default\": 2022, \"description\": \"Port that dockerized nova migration target sshd service binds to.\", \"type\": \"number\"}, \"MigrationSshKey\": {\"type\": \"json\", \"description\": \"SSH key for migration. Expects a dictionary with keys 'public_key' and 'private_key'. Values should be identical to SSH public/private key files.\\n\", \"default\": {\"public_key\": \"\", \"private_key\": \"\"}}, \"MigrationSshPort\": {\"default\": 2022, \"description\": \"Target port for migration over ssh\", \"type\": \"number\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"SshdBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/sshd/sshd-baremetal-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaComputeImage\": \"ContainerNovaComputeImage\", \"ContainerNovaLibvirtConfigImage\": \"ContainerNovaLibvirtConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaComputeImage\": {\"get_param\": \"ContainerNovaComputeImage\"}, \"ContainerNovaLibvirtConfigImage\": {\"get_param\": \"ContainerNovaLibvirtConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova Migration Target service.\", \"value\": {\"service_name\": \"nova_migration_target\", \"firewall_rules\": {\"map_merge\": [{\"map_merge\": {\"repeat\": {\"for_each\": {\"<%net_cidr%>\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}]}}, \"template\": {\"113 nova_migration_target accept libvirt subnet <%net_cidr%>\": {\"source\": \"<%net_cidr%>\", \"proto\": \"tcp\", \"dport\": {\"get_param\": \"MigrationSshPort\"}}}}}}, {\"map_merge\": {\"repeat\": {\"for_each\": {\"<%net_cidr%>\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}]}}, \"template\": {\"113 nova_migration_target accept api subnet <%net_cidr%>\": {\"source\": \"<%net_cidr%>\", \"proto\": \"tcp\", \"dport\": {\"get_param\": \"MigrationSshPort\"}}}}}}]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"SshdBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::profile::base::nova::migration::target::ssh_authorized_keys\": [{\"get_param\": [\"MigrationSshKey\", \"public_key\"]}], \"tripleo::profile::base::nova::migration::target::ssh_localaddrs\": [\"%{hiera('cold_migration_ssh_inbound_addr')}\", \"%{hiera('live_migration_ssh_inbound_addr')}\"], \"live_migration_ssh_inbound_addr\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}, \"cold_migration_ssh_inbound_addr\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaApiNetwork\"]}}}}, \"tripleo::profile::base::sshd::port\": [22]}]}, \"puppet_config\": {\"config_volume\": \"nova_libvirt\", \"step_config\": {\"list_join\": [\"\\n\", [{\"get_attr\": [\"SshdBase\", \"role_data\", \"step_config\"]}, \"include tripleo::profile::base::nova::migration::target\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaLibvirtConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova-migration-target.json\": {\"command\": {\"str_replace\": {\"template\": \"dumb-init --single-child -- /usr/sbin/sshd -D -p SSHDPORT\", \"params\": {\"SSHDPORT\": {\"get_param\": \"DockerNovaMigrationSshdPort\"}}}}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/host-ssh/ssh_host_*_key\", \"dest\": \"/etc/ssh/\", \"owner\": \"root\", \"perm\": \"0600\"}]}}, \"host_prep_tasks\": [{\"name\": \"Create libvirt persistent data directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\"}, \"loop\": [{\"path\": \"/run/libvirt\", \"setype\": \"virt_var_run_t\"}]}, {\"name\": \"ensure /run/libvirt is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-libvirt.conf\", \"content\": \"d /run/libvirt 0755 root root - -\\n\"}}], \"docker_config\": {\"step_4\": {\"nova_migration_target\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaComputeImage\"]}, \"net\": \"host\", \"privileged\": true, \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova-migration-target.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova_libvirt:/var/lib/kolla/config_files/src:ro\", \"/etc/ssh:/host-ssh:ro\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/lib/nova:/var/lib/nova:shared\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"deploy_steps_tasks\": [{\"name\": \"validate nova-migration-target container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_migration_target\"}, \"register\": \"nova_migration_target_infos\", \"failed_when\": [\"nova_migration_target_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_migration_target_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 5\"]}], \"update_tasks\": [{\"name\": \"nova_migration_target_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-libvirt.conf\", \"state\": \"absent\"}}]}], \"upgrade_tasks\": [{\"name\": \"nova_migration_target_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-libvirt.conf\", \"state\": \"absent\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/container_config_scripts/placement_wait_for_service.py": "#!/usr/bin/python3\n#\n# Copyright 2018 Red Hat Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n# not use this file except in compliance with the License. You may obtain\n# a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n# License for the specific language governing permissions and limitations\n# under the License.\n\n# shell script to check if placement API is up after X attempts.\n# Default max is 60 iterations with 10s (default) timeout in between.\n\nimport logging\nimport os\nimport re\nimport six\nimport sys\nimport time\n\nfrom keystoneauth1.identity import v3\nfrom keystoneauth1 import session\nfrom keystoneclient.v3 import client\nimport requests\n\n# In python3 SafeConfigParser was renamed to ConfigParser and the default\n# for duplicate options default to true. In case of nova it is valid to\n# have duplicate option lines, e.g. passthrough_whitelist which leads to\n# issues reading the nova.conf\n# https://bugs.launchpad.net/tripleo/+bug/1827775\nif six.PY3:\n    from six.moves.configparser import ConfigParser\n    config = ConfigParser(strict=False)\nelse:\n    from six.moves.configparser import SafeConfigParser\n    config = SafeConfigParser()\n\n\ndebug = os.getenv('__OS_DEBUG', 'false')\n\nif debug.lower() == 'true':\n    loglevel = logging.DEBUG\nelse:\n    loglevel = logging.INFO\n\nlogging.basicConfig(stream=sys.stdout, level=loglevel)\nLOG = logging.getLogger('placement_wait_for_service')\n\niterations = 60\ntimeout = 10\nplacement_cfg = '/etc/placement/placement.conf'\n\nif __name__ == '__main__':\n    if os.path.isfile(placement_cfg):\n        try:\n            config.read(placement_cfg)\n        except Exception:\n            LOG.exception('Error while reading placement.conf:')\n    else:\n        LOG.error('Placement configuration file %s does not exist',\n                  placement_cfg)\n        sys.exit(1)\n\n    # get keystone client with details from [keystone_authtoken] section\n    auth = v3.Password(\n        user_domain_name=config.get('keystone_authtoken', 'user_domain_name'),\n        username=config.get('keystone_authtoken', 'username'),\n        password=config.get('keystone_authtoken', 'password'),\n        project_name=config.get('keystone_authtoken', 'project_name'),\n        project_domain_name=config.get('keystone_authtoken',\n                                       'project_domain_name'),\n        auth_url=config.get('keystone_authtoken', 'auth_url') + '/v3')\n    sess = session.Session(auth=auth, verify=False)\n    keystone = client.Client(session=sess, interface='internal')\n\n    iterations_endpoint = iterations\n    placement_endpoint_url = None\n    while iterations_endpoint > 1:\n        iterations_endpoint -= 1\n        try:\n            # get placement service id\n            placement_service_id = keystone.services.list(\n                name='placement')[0].id\n\n            # get placement endpoint\n            # Note: puppet-placement does not support setting the interface\n            #       until we have https://review.opendev.org/688862.\n            #       Lets hard code 'internal' for now.\n            placement_endpoint_url = keystone.endpoints.list(\n                service=placement_service_id,\n                region=config.get('keystone_authtoken', 'region_name'),\n                interface='internal')[0].url\n            if not placement_endpoint_url:\n                LOG.error('Failed to get placement service endpoint!')\n            else:\n                break\n        except Exception:\n            LOG.exception('Retry - Failed to get placement service endpoint:')\n        time.sleep(timeout)\n\n    if not placement_endpoint_url:\n        LOG.error('Failed to get placement service endpoint!')\n        sys.exit(1)\n\n    # we should have CURRENT in the request response from placement:\n    # {\"versions\": [{\"status\": \"CURRENT\", \"min_version\": \"1.0\", \"max_version\":\n    # \"1.29\", \"id\": \"v1.0\", \"links\": [{\"href\": \"\", \"rel\": \"self\"}]}]}\n    response_reg = re.compile('.*CURRENT,*')\n\n    while iterations > 1:\n        iterations -= 1\n        try:\n            r = requests.get(placement_endpoint_url + '/', verify=False)\n            if r.status_code == 200 and response_reg.match(r.text):\n                LOG.info('Placement service up! - %s', r.text)\n                sys.exit(0)\n                break\n            else:\n                LOG.info('response - %r', r)\n                LOG.info('Placement service not up - %s, %s',\n                         r.status_code,\n                         r.text)\n        except Exception:\n            LOG.exception('Error query the placement endpoint:')\n        time.sleep(timeout)\n\n    sys.exit(1)\n\n# vim: set et ts=4 sw=4 :\n", "file:///root/tripleo-heat-installer-templates/deployment/placement/placement-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Placement API service\\n\", \"parameters\": {\"ContainerPlacementImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerPlacementConfigImage\": {\"description\": \"The container image to use for the placement config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"PlacementWorkers\": {\"default\": 0, \"description\": \"Number of workers for Placement services.\", \"type\": \"number\"}, \"PlacementPassword\": {\"description\": \"The password for the Placement service and db account\", \"type\": \"string\", \"hidden\": true}, \"PlacementAPIInterface\": {\"type\": \"string\", \"description\": \"Endpoint interface to be used for the placement API.\\n\", \"default\": \"internal\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionPlacement\": {\"default\": \"overcloud-placement\", \"type\": \"string\"}, \"PlacementLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.placement\", \"file\": \"/var/log/containers/placement/placement.log\"}}, \"NovaPassword\": {\"description\": \"The password for the nova service and db account\", \"type\": \"string\", \"hidden\": true}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"PlacementDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Placement services.\", \"type\": \"boolean\"}, \"PlacementPolicies\": {\"description\": \"A hash of policies to configure for Placement API.\\ne.g. { nova-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}}, \"conditions\": {\"placement_workers_zero\": {\"equals\": [{\"get_param\": \"PlacementWorkers\"}, 0]}, \"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"enable_sqlalchemy_collectd\": {\"equals\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, true]}}, \"resources\": {\"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"PlacementLogging\": {\"type\": \"OS::TripleO::Services::Logging::PlacementApi\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerPlacementImage\": \"ContainerPlacementImage\", \"ContainerPlacementConfigImage\": \"ContainerPlacementConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerPlacementImage\": {\"get_param\": \"ContainerPlacementImage\"}, \"ContainerPlacementConfigImage\": {\"get_param\": \"ContainerPlacementConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Placement API role.\", \"value\": {\"service_name\": \"placement\", \"firewall_rules\": {\"138 placement\": {\"dport\": [8778]}}, \"firewall_frontend_rules\": {\"100 placement_haproxy_frontend\": {\"dport\": [8778]}}, \"firewall_ssl_frontend_rules\": {\"100 placement_haproxy_frontend_ssl\": {\"dport\": [13778]}}, \"keystone_resources\": {\"placement\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"PlacementPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"PlacementInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"PlacementAdmin\", \"uri\"]}}, \"users\": {\"placement\": {\"password\": {\"get_param\": \"PlacementPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"placement\"}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"PlacementLogging\", \"config_settings\"]}, {\"apache::default_vhost\": false}, {\"placement::keystone::authtoken::project_name\": \"service\", \"placement::keystone::authtoken::password\": {\"get_param\": \"PlacementPassword\"}, \"placement::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"placement::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"placement::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"placement::keystone::authtoken::interface\": \"internal\", \"placement::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"placement::logging::debug\": {\"if\": [{\"get_param\": \"PlacementDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"placement::policy::enforce_new_defaults\": {\"get_param\": \"EnforceSecureRbac\"}, \"placement::policy::enforce_scope\": {\"get_param\": \"EnforceSecureRbac\"}, \"placement::policy::policies\": {\"get_param\": \"PlacementPolicies\"}, \"placement::wsgi::apache::api_port\": \"8778\", \"placement::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"placement::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}}}, \"placement::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"PlacementNetwork\"]}}}}, \"placement::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"placement\", \"password\": {\"get_param\": \"PlacementPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/placement\", \"query\": {\"if\": [\"enable_sqlalchemy_collectd\", {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"placement_api\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}}, {\"if\": [\"placement_workers_zero\", {}, {\"placement::wsgi::apache::workers\": {\"get_param\": \"PlacementWorkers\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_placement\": [{\"get_param\": \"PlacementLoggingSource\"}]}, \"mysql\": {\"placement::db::mysql::password\": {\"get_param\": \"PlacementPassword\"}, \"placement::db::mysql::user\": \"placement\", \"placement::db::mysql::host\": \"%\", \"placement::db::mysql::dbname\": \"placement\"}}, \"puppet_config\": {\"config_volume\": \"placement\", \"puppet_tags\": \"placement_config\", \"step_config\": {\"list_join\": [\"\\n\", [{\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}, \"include tripleo::profile::base::placement::api\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerPlacementConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/placement_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/placement\", \"owner\": \"placement:placement\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/placement_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec placement su placement -s /bin/bash -c '/usr/bin/placement-manage db sync'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/placement\", \"owner\": \"placement:placement\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/placement_api_wait_for_service.json\": {\"command\": \"/usr/bin/bootstrap_host_exec placement su placement -s /bin/bash -c '/container-config-scripts/pyshim.sh /container-config-scripts/placement_wait_for_service.py'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/placement\", \"owner\": \"placement:placement\", \"recurse\": true}]}}, \"container_config_scripts\": {\"map_merge\": [{\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, {\"placement_wait_for_service.py\": {\"mode\": \"0755\", \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/container_config_scripts/placement_wait_for_service.py\"}}}]}, \"docker_config\": {\"step_2\": {\"get_attr\": [\"PlacementLogging\", \"docker_config\", \"step_2\"]}, \"step_3\": {\"placement_api_db_sync\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerPlacementImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"PlacementLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/placement_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"placement_api\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerPlacementImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"PlacementLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/placement_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro\"], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\"], []]}, {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"], []]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"placement_wait_for_service\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerPlacementImage\"]}, \"user\": \"root\", \"net\": \"host\", \"privileged\": false, \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"PlacementLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/placement_api_wait_for_service.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/placement:/var/lib/kolla/config_files/src:ro\", \"/var/lib/container-config-scripts:/container-config-scripts:z\"]]}, \"environment\": {\"__OS_DEBUG\": {\"yaql\": {\"expression\": \"str($.data.debug)\", \"data\": {\"debug\": {\"get_param\": \"Debug\"}}}}, \"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"get_attr\": [\"PlacementLogging\", \"host_prep_tasks\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"upgrade_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-scheduler-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova Scheduler service\\n\", \"parameters\": {\"ContainerNovaSchedulerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaConfigImage\": {\"description\": \"The container image to use for the nova config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaSchedulerLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.nova.scheduler\", \"file\": \"/var/log/containers/nova/nova-scheduler.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"NovaSchedulerAvailableFilters\": {\"default\": [], \"description\": \"List of scheduler available filters\", \"type\": \"comma_delimited_list\"}, \"NovaSchedulerEnabledFilters\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"An array of filters used by Nova to filter a node. These filters will be applied in the order they are listed, so place your most restrictive filters first to make the filtering process more efficient.\\n\"}, \"NovaSchedulerMaxAttempts\": {\"type\": \"number\", \"default\": 3, \"description\": \"Maximum number of attempts the scheduler will make when deploying the instance. You should keep it greater or equal to the number of bare metal nodes you expect to deploy at once to work around potential race conditions when scheduling.\\n\"}, \"MonitoringSubscriptionNovaScheduler\": {\"default\": \"overcloud-nova-scheduler\", \"type\": \"string\"}, \"NovaSchedulerDiscoverHostsInCellsInterval\": {\"type\": \"number\", \"default\": -1, \"description\": \"This value controls how often (in seconds) the scheduler should attempt to discover new hosts that have been added to cells. The default value of -1 disables the periodic task completely. It is recommended to set this parameter for deployments using Ironic.\\n\"}, \"NovaSchedulerWorkers\": {\"default\": 0, \"description\": \"Number of workers for Nova Scheduler services.\", \"type\": \"number\"}, \"NovaSchedulerQueryImageType\": {\"type\": \"boolean\", \"default\": true, \"description\": \"This setting causes the scheduler to ask placement only for compute hosts that support the disk_format of the image used in the request.\\n\"}, \"NovaSchedulerLimitTenantsToPlacementAggregate\": {\"default\": false, \"description\": \"This value allows to have tenant isolation with placement. It ensures hosts in tenant-isolated host aggregate and availability zones will only be available to specific set of tenants.\\n\", \"type\": \"boolean\"}, \"NovaSchedulerPlacementAggregateRequiredForTenants\": {\"default\": false, \"description\": \"This setting, when `NovaSchedulerLimitTenantsToPlacementAggregate` is true, controls whether or not a tenant with no aggregate affinity will be allowed to schedule to any available node. If aggregates are used to limit some tenants but not all, then this should be False. If all tenants should be confined via aggregate, then this should be True.\\n\", \"type\": \"boolean\"}, \"NovaSchedulerEnableIsolatedAggregateFiltering\": {\"default\": false, \"description\": \"This setting allows the scheduler to restrict hosts in aggregates based on matching required traits in the aggregate metadata and the instance flavor/image. If an aggregate is configured with a property with key trait:$TRAIT_NAME and value required, the instance flavor extra_specs and/or image metadata must also contain trait:$TRAIT_NAME=required to be eligible to be scheduled to hosts in that aggregate.\\n\", \"type\": \"boolean\"}, \"NovaSchedulerQueryPlacementForAvailabilityZone\": {\"default\": false, \"description\": \"This setting allows the scheduler to look up a host aggregate with metadata key of availability zone set to the value provided by incoming request, and request result from placement be limited to that aggregate.\\n\", \"type\": \"boolean\"}, \"NovaSchedulerQueryPlacementForRoutedNetworkAggregates\": {\"default\": false, \"description\": \"This setting allows the scheduler to verify if the requested networks or port are related to neutron routed network. This requires that the related aggregates to be reported in placement, so only hosts within the asked aggregates would be accepted.\\n\", \"type\": \"boolean\"}, \"NovaSchedulerHostSubsetSize\": {\"default\": 1, \"description\": \"Size of subset of best hosts selected by scheduler.\\n\", \"type\": \"number\"}, \"NovaSchedulerShuffleBestSameWeighedHosts\": {\"default\": false, \"description\": \"Enable spreading the instances between hosts with the same best weight.\\n\", \"type\": \"boolean\"}, \"NovaSchedulerDefaultFilters\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"(DEPRECATED) An array of filters used by Nova to filter a node. These filters will be applied in the order they are listed, so place your most restrictive filters first to make the filtering process more efficient.\\n\"}}, \"conditions\": {\"nova_scheduler_workers_set\": {\"not\": {\"equals\": [{\"get_param\": \"NovaSchedulerWorkers\"}, 0]}}, \"scheduler_default_filters\": {\"not\": {\"equals\": [{\"get_param\": \"NovaSchedulerDefaultFilters\"}, []]}}, \"disabled_scheduler_enabled_filters\": {\"equals\": [{\"get_param\": \"NovaSchedulerEnabledFilters\"}, []]}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenstack mailing list.\\n\", \"parameters\": [\"NovaSchedulerDefaultFilters\"]}], \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"NovaLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaCommon\", \"properties\": {\"ContainerNovaImage\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaSchedulerImage\"]}, \"NovaServiceName\": \"scheduler\"}}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaApiDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-apidb-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-db-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaSchedulerImage\": \"ContainerNovaSchedulerImage\", \"ContainerNovaConfigImage\": \"ContainerNovaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaSchedulerImage\": {\"get_param\": \"ContainerNovaSchedulerImage\"}, \"ContainerNovaConfigImage\": {\"get_param\": \"ContainerNovaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova Scheduler service.\", \"value\": {\"service_name\": \"nova_scheduler\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNovaScheduler\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaLogging\", \"config_settings\"]}, {\"nova::scheduler::filter::scheduler_available_filters\": {\"get_param\": \"NovaSchedulerAvailableFilters\"}, \"nova::scheduler::filter::scheduler_enabled_filters\": {\"if\": [{\"and\": [\"scheduler_default_filters\", \"disabled_scheduler_enabled_filters\"]}, {\"get_param\": \"NovaSchedulerDefaultFilters\"}, {\"get_param\": \"NovaSchedulerEnabledFilters\"}]}, \"nova::scheduler::filter::scheduler_max_attempts\": {\"get_param\": \"NovaSchedulerMaxAttempts\"}, \"nova::scheduler::filter::scheduler_host_subset_size\": {\"get_param\": \"NovaSchedulerHostSubsetSize\"}, \"nova::scheduler::filter::shuffle_best_same_weighed_hosts\": {\"get_param\": \"NovaSchedulerShuffleBestSameWeighedHosts\"}, \"nova::scheduler::discover_hosts_in_cells_interval\": {\"get_param\": \"NovaSchedulerDiscoverHostsInCellsInterval\"}, \"nova::scheduler::query_placement_for_image_type_support\": {\"get_param\": \"NovaSchedulerQueryImageType\"}, \"nova::scheduler::limit_tenants_to_placement_aggregate\": {\"get_param\": \"NovaSchedulerLimitTenantsToPlacementAggregate\"}, \"nova::scheduler::placement_aggregate_required_for_tenants\": {\"get_param\": \"NovaSchedulerPlacementAggregateRequiredForTenants\"}, \"nova::scheduler::enable_isolated_aggregate_filtering\": {\"get_param\": \"NovaSchedulerEnableIsolatedAggregateFiltering\"}, \"nova::scheduler::query_placement_for_availability_zone\": {\"get_param\": \"NovaSchedulerQueryPlacementForAvailabilityZone\"}, \"nova::scheduler::query_placement_for_routed_network_aggregates\": {\"get_param\": \"NovaSchedulerQueryPlacementForRoutedNetworkAggregates\"}, \"nova::scheduler::workers\": {\"if\": [\"nova_scheduler_workers_set\", {\"get_param\": \"NovaSchedulerWorkers\"}]}}]}, \"service_config_settings\": {\"rabbitmq\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"service_config_settings\"], \"rabbitmq\": null}, \"mysql\": {\"map_merge\": [{\"get_attr\": [\"NovaApiDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}]}, \"rsyslog\": {\"tripleo_logging_sources_nova_scheduler\": [{\"get_param\": \"NovaSchedulerLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"nova\", \"puppet_tags\": \"nova_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::nova::scheduler\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_scheduler.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/nova-scheduler\", {\"get_attr\": [\"NovaLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}]}}, \"docker_config\": {\"step_4\": {\"nova_scheduler\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaSchedulerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_scheduler.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"deploy_steps_tasks\": [{\"name\": \"validate nova-scheduler container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_scheduler\"}, \"register\": \"nova_scheduler_infos\", \"failed_when\": [\"nova_scheduler_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_scheduler_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 5\"]}], \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLogging\", \"host_prep_tasks\"]}, [{\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop nova scheduler container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"nova_scheduler\"], \"tripleo_delegate_to\": \"{{ groups['nova_scheduler'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/nova/nova-vnc-proxy-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova Vncproxy service\\n\", \"parameters\": {\"ContainerNovaVncProxyImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNovaConfigImage\": {\"description\": \"The container image to use for the nova config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NovaVncproxyLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.nova.vncproxy\", \"file\": \"/var/log/containers/nova/nova-novncproxy.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"UseTLSTransportForVnc\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If set to true and if EnableInternalTLS is enabled, it will enable TLS transaport for libvirt VNC and configure the relevant keys for libvirt.\"}, \"InternalTLSVncProxyCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the CA cert to use for VNC TLS.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"NovaVNCCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"LibvirtVNCClientCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}, \"LibvirtVncCACert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"This specifies the CA certificate to use for VNC TLS. This file will be symlinked to the default CA path, which is /etc/pki/CA/certs/vnc.crt. This parameter should be used if the default (which comes from the InternalTLSVncProxyCAFile parameter) is not desired. The current default reflects TripleO's default CA, which is FreeIPA. It will only be used if internal TLS is enabled.\"}, \"NovaVNCProxySSLCiphers\": {\"type\": \"string\", \"default\": \"\", \"description\": \"OpenSSL cipher preference string that specifies what ciphers to allow for TLS connections from clients.  See the man page for the OpenSSL 'ciphers' command for details of the cipher preference string format and allowed values.\"}, \"NovaVNCProxySSLMinimumVersion\": {\"type\": \"string\", \"default\": \"default\", \"description\": \"Minimum allowed SSL/TLS protocol version.  Valid values are 'default', 'tlsv1_1', 'tlsv1_2', and 'tlsv1_3'.  A value of 'default' will use the underlying system OpenSSL defaults.\", \"constraints\": [{\"allowed_values\": [\"default\", \"tlsv1_1\", \"tlsv1_2\", \"tlsv1_3\"]}]}, \"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"AuthCloudName\": {\"description\": \"Entry in clouds.yaml to use for authentication\", \"type\": \"string\", \"default\": \"\"}}, \"conditions\": {\"auth_cloud_name_set\": {\"not\": {\"equals\": [{\"get_param\": \"AuthCloudName\"}, \"\"]}}, \"use_tls_for_vnc\": {\"and\": [{\"get_param\": \"EnableInternalTLS\"}, {\"get_param\": \"UseTLSTransportForVnc\"}]}, \"libvirt_vnc_specific_ca_set\": {\"not\": {\"equals\": [{\"get_param\": \"LibvirtVncCACert\"}, \"\"]}}, \"proxy_ssl_ciphers_set\": {\"not\": {\"equals\": [{\"get_param\": \"NovaVNCProxySSLCiphers\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"NovaLogging\": {\"type\": \"OS::TripleO::Services::Logging::NovaCommon\", \"properties\": {\"ContainerNovaImage\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaVncProxyImage\"]}, \"NovaServiceName\": \"vncproxy\"}}, \"NovaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-base-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NovaDBClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/nova/nova-db-client-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaVncProxyImage\": \"ContainerNovaVncProxyImage\", \"ContainerNovaConfigImage\": \"ContainerNovaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaVncProxyImage\": {\"get_param\": \"ContainerNovaVncProxyImage\"}, \"ContainerNovaConfigImage\": {\"get_param\": \"ContainerNovaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Nova Vncproxy service.\", \"value\": {\"service_name\": \"nova_vnc_proxy\", \"firewall_rules\": {\"137 nova_vnc_proxy\": {\"dport\": [6080]}}, \"firewall_frontend_rules\": {\"100 nova_vncproxy_haproxy_frontend\": {\"dport\": [6080]}}, \"firewall_ssl_frontend_rules\": {\"100 nova_vncproxy_haproxy_frontend_ssl\": {\"dport\": [13080]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NovaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaDBClient\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NovaLogging\", \"config_settings\"]}, {\"nova::vncproxy::enabled\": true, \"nova::vncproxy::common::vncproxy_protocol\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyCellPublic\", \"protocol\"]}, \"nova::vncproxy::common::vncproxy_host\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyCellPublic\", \"host_nobrackets\"]}, \"nova::vncproxy::common::vncproxy_port\": {\"get_param\": [\"EndpointMap\", \"NovaVNCProxyCellPublic\", \"port\"]}, \"nova::vncproxy::host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}}, {\"if\": [\"use_tls_for_vnc\", {\"nova::vncproxy::allow_vencrypt\": true, \"nova::vncproxy::vencrypt_key\": \"/etc/pki/tls/private/libvirt-vnc-client-cert.key\", \"nova::vncproxy::vencrypt_cert\": \"/etc/pki/tls/certs/libvirt-vnc-client-cert.crt\", \"nova::vncproxy::vencrypt_ca\": \"/etc/pki/CA/certs/vnc.crt\", \"nova::ssl_only\": true, \"nova::console_ssl_ciphers\": {\"if\": [\"proxy_ssl_ciphers_set\", {\"get_param\": \"NovaVNCProxySSLCiphers\"}]}, \"nova::console_ssl_minimum_version\": {\"get_param\": \"NovaVNCProxySSLMinimumVersion\"}, \"nova::cert\": \"/etc/pki/tls/certs/novnc-proxy.crt\", \"nova::key\": \"/etc/pki/tls/private/novnc-proxy.key\"}]}]}, \"service_config_settings\": {\"rabbitmq\": {\"get_attr\": [\"NovaBase\", \"role_data\", \"service_config_settings\"], \"rabbitmq\": null}, \"mysql\": {\"map_merge\": [{\"get_attr\": [\"NovaDBClient\", \"role_data\", \"service_config_settings\", \"mysql\"]}]}, \"rsyslog\": {\"tripleo_logging_sources_nova_vnc_proxy\": [{\"get_param\": \"NovaVncproxyLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"nova\", \"puppet_tags\": \"nova_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::nova::vncproxy\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/nova_vnc_proxy.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/nova-novncproxy --web /usr/share/novnc/\", {\"get_attr\": [\"NovaLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/nova\", \"owner\": \"nova:nova\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/novnc-proxy.crt\", \"owner\": \"root:root\", \"perm\": \"0644\"}, {\"path\": \"/etc/pki/tls/private/novnc-proxy.key\", \"owner\": \"root:qemu\", \"perm\": \"0640\"}, {\"path\": \"/etc/pki/tls/certs/libvirt-vnc-client-cert.crt\", \"owner\": \"root:root\", \"perm\": \"0644\"}, {\"path\": \"/etc/pki/tls/private/libvirt-vnc-client-cert.key\", \"owner\": \"root:qemu\", \"perm\": \"0640\"}]}}, \"docker_config\": {\"step_4\": {\"nova_vnc_proxy\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaVncProxyImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NovaLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/nova_vnc_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/nova:/var/lib/kolla/config_files/src:ro\"], {\"if\": [\"use_tls_for_vnc\", [{\"str_replace\": {\"template\": \"CACERT:/etc/pki/CA/certs/vnc.crt:ro\", \"params\": {\"CACERT\": {\"if\": [\"libvirt_vnc_specific_ca_set\", {\"get_param\": \"LibvirtVncCACert\"}, {\"get_param\": \"InternalTLSVncProxyCAFile\"}]}}}}, \"/etc/pki/tls/certs/libvirt-vnc-client-cert.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/libvirt-vnc-client-cert.crt:ro\", \"/etc/pki/tls/private/libvirt-vnc-client-cert.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/libvirt-vnc-client-cert.key:ro\", \"/etc/pki/tls/certs/novnc-proxy.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/novnc-proxy.crt:ro\", \"/etc/pki/tls/private/novnc-proxy.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/novnc-proxy.key:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"if\": [\"use_tls_for_vnc\", [{\"service\": \"libvirt-vnc\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}, {\"service\": \"novnc-proxy\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}, \"type\": \"node\"}]]}, \"deploy_steps_tasks\": {\"list_concat\": [[{\"name\": \"validate nova-vnc-proxy container state\", \"containers.podman.podman_container_info\": {\"name\": \"nova_vnc_proxy\"}, \"register\": \"nova_vnc_proxy_infos\", \"failed_when\": [\"nova_vnc_proxy_infos.containers.0.Healthcheck.Status is defined\", \"'healthy' not in nova_vnc_proxy_infos.containers.0.Healthcheck.Status\"], \"retries\": 10, \"delay\": 30, \"tags\": [\"opendev-validation\", \"opendev-validation-nova\"], \"when\": [\"container_cli == 'podman'\", \"not container_healthcheck_disabled\", \"step|int == 5\"]}], {\"if\": [\"use_tls_for_vnc\", [{\"name\": \"Certificate generation\", \"when\": \"step|int == 1\", \"vars\": {\"cert_key_size\": {\"get_param\": \"CertificateKeySize\"}, \"nova_vnc_key_size\": {\"get_param\": \"NovaVNCCertificateKeySize\"}, \"libvirt_vnc_key_size\": {\"get_param\": \"LibvirtVNCClientCertificateKeySize\"}, \"libvirt_network\": {\"str_replace\": {\"template\": \"{{ fqdn_NETWORK }}\", \"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NovaLibvirtNetwork\"]}}}}}, \"block\": [{\"name\": \"Execute system role for Nova/Libvirt VNC certs\", \"loop\": [{\"name\": \"libvirt-vnc-client-cert\", \"key_size\": \"{{ libvirt_vnc_key_size | default(cert_key_size, true) }}\", \"principal\": \"libvirt-vnc/{{ libvirt_network }}@{{ idm_realm }}\"}, {\"name\": \"novnc-proxy\", \"key_size\": \"{{ nova_vnc_key_size | default(cert_key_size, true) }}\", \"principal\": \"novnc-proxy/{{ libvirt_network }}@{{ idm_realm }}\"}], \"loop_control\": {\"loop_var\": \"cert\"}, \"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"{{ cert.name }}\", \"dns\": \"{{ libvirt_network }}\", \"principal\": \"{{ cert.principal }}\", \"key_size\": \"{{ cert.key_size }}\", \"run_after\": \"container_name=$({{container_cli}} ps --format=\\\\{\\\\{.Names\\\\}\\\\} | grep nova_vnc_proxy)\\nservice_crt=\\\"/etc/pki/tls/certs/{{ cert.name }}.crt\\\"\\nservice_key=\\\"/etc/pki/tls/private/{{ cert.name }}.key\\\"\\n# Copy the new cert from the mount-point to the real path\\n{{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_crt\\\" \\\"$service_crt\\\"\\n# Copy the new key from the mount-point to the real path\\n{{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_key\\\" \\\"$service_key\\\"\\n\\n# Set permissions\\n{{container_cli}} exec -u root \\\"$container_name\\\" chmod 0644 $service_crt\\n{{container_cli}} exec -u root \\\"$container_name\\\" chmod 0640 $service_key\\n{{container_cli}} exec -u root \\\"$container_name\\\" chgrp qemu $service_key\\n\\n# No need to trigger a reload for novnc proxy since the cert is not cached\\n\", \"ca\": \"ipa\"}]}}]}]]}]}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NovaLogging\", \"host_prep_tasks\"]}, [{\"name\": \"ensure qemu group is present on the host\", \"group\": {\"name\": \"qemu\", \"gid\": 107, \"state\": \"present\"}}, {\"name\": \"ensure qemu user is present on the host\", \"user\": {\"name\": \"qemu\", \"uid\": 107, \"group\": \"qemu\", \"state\": \"present\", \"shell\": \"/sbin/nologin\", \"comment\": \"qemu user\"}}]]}, \"post_upgrade_tasks\": [{\"when\": [\"step|int == 3\"], \"become\": true, \"environment\": {\"OS_CLOUD\": {\"if\": [\"auth_cloud_name_set\", {\"get_param\": \"AuthCloudName\"}, {\"get_param\": \"RootStackName\"}]}}, \"block\": [{\"name\": \"Get nova-consoleauth service ID\", \"command\": \"openstack compute service list --service nova-consoleauth --column ID  --column Host --format yaml\", \"register\": \"nova_compute_service_result\", \"check_mode\": false, \"run_once\": true, \"changed_when\": false, \"failed_when\": false, \"delegate_to\": \"{{ groups['Undercloud'] | first }}\"}, {\"name\": \"Deleting nova-consoleauth\", \"command\": \"openstack compute service delete {{ item.ID }}\", \"loop\": \"{{ nova_compute_service_result.stdout | from_yaml | default([]) }}\", \"run_once\": true, \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"failed_when\": false}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop nova vnc proxy container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"nova_vnc_proxy\"], \"tripleo_delegate_to\": \"{{ groups['nova_vnc_proxy'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/logrotate/logrotate-crond-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Containerized logrotate with crond for containerized service logs rotation\\n\", \"parameters\": {\"ContainerCrondImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCrondConfigImage\": {\"description\": \"The container image to use for the crond config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"LogrotateMaxsize\": {\"description\": \"Configures the maxsize param for containerized logrotate.\", \"type\": \"string\", \"default\": \"10M\"}, \"LogrotateRotationInterval\": {\"description\": \"Configures rotation interval for containerized logrotate.\", \"type\": \"string\", \"default\": \"daily\", \"constraints\": [{\"allowed_values\": [\"hourly\", \"daily\", \"weekly\", \"monthly\"]}]}, \"LogrotateRotate\": {\"description\": \"Configures the rotate param for containerized logrotate.\", \"type\": \"string\", \"default\": \"14\"}, \"LogrotatePurgeAfterDays\": {\"description\": \"Enforces life time (days) of rotated and compressed files.\", \"type\": \"string\", \"default\": \"14\"}, \"LogrotateDateExt\": {\"description\": \"Enable/disable dateext parameter.\", \"type\": \"boolean\", \"default\": false}, \"LogrotateDateFormat\": {\"description\": \"Configures dateformat strings for containerized logrotate. This is valid when LogrotateDateExt is true. The allowed specifiers are only %Y %m %d %H %M %S %V and %s.\", \"type\": \"string\", \"default\": \"-%Y%m%d\", \"constraints\": [{\"allowed_pattern\": \"-(%[YmdHMSVs])+$\"}]}, \"LogrotateDateYesterday\": {\"description\": \"Configures dateyesterday paramter for containerized logrotate. This is valid when LogrotateDateExt is true.\", \"type\": \"boolean\", \"default\": false}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCrondImage\": \"ContainerCrondImage\", \"ContainerCrondConfigImage\": \"ContainerCrondConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCrondImage\": {\"get_param\": \"ContainerCrondImage\"}, \"ContainerCrondConfigImage\": {\"get_param\": \"ContainerCrondConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the crond role.\", \"value\": {\"service_name\": \"logrotate_crond\", \"config_settings\": {\"map_merge\": [{\"tripleo::profile::base::logging::logrotate::maxsize\": {\"get_param\": \"LogrotateMaxsize\"}, \"tripleo::profile::base::logging::logrotate::rotation\": {\"get_param\": \"LogrotateRotationInterval\"}, \"tripleo::profile::base::logging::logrotate::rotate\": {\"get_param\": \"LogrotateRotate\"}, \"tripleo::profile::base::logging::logrotate::purge_after_days\": {\"get_param\": \"LogrotatePurgeAfterDays\"}, \"tripleo::profile::base::logging::logrotate::dateext\": {\"get_param\": \"LogrotateDateExt\"}}, {\"if\": [{\"get_param\": \"LogrotateDateExt\"}, {\"tripleo::profile::base::logging::logrotate::dateformat\": {\"get_param\": \"LogrotateDateFormat\"}, \"tripleo::profile::base::logging::logrotate::dateyesterday\": {\"get_param\": \"LogrotateDateYesterday\"}}]}]}, \"host_prep_tasks\": [{\"name\": \"allow logrotate to read inside containers\", \"seboolean\": {\"name\": \"logrotate_read_inside_containers\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}], \"deploy_steps_tasks\": [{\"name\": \"configure tmpwatch on the host\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Push script\", \"copy\": {\"dest\": \"/usr/local/sbin/containers-tmpwatch\", \"owner\": \"root\", \"group\": \"root\", \"mode\": 493, \"content\": \"#!/bin/sh\\ntmpwatch --nodirs \\\\\\n  -X \\\"/var/log/containers/*/*log\\\" \\\\\\n  -X \\\"/var/log/containers/*/*/*log\\\" \\\\\\n  -X \\\"/var/log/containers/*/*err\\\" \\\\\\n  {{ LogrotatePurgeAfterDays|int +1 }}d \\\\\\n  /var/log/containers/ 2>&1 | logger -t container-tmpwatch\\n\"}, \"vars\": {\"LogrotatePurgeAfterDays\": {\"get_param\": \"LogrotatePurgeAfterDays\"}}}, {\"name\": \"Insert cronjob in root crontab\", \"cron\": {\"name\": \"Remove old logs\", \"special_time\": \"daily\", \"user\": \"root\", \"job\": \"/usr/local/sbin/containers-tmpwatch\"}}]}], \"update_tasks\": [{\"name\": \"Ensure old cron.daily is absent\", \"when\": \"step|int == 1\", \"file\": {\"path\": \"/etc/cron.daily/containers-tmpwatch\", \"state\": \"absent\"}}], \"upgrade_tasks\": [{\"name\": \"Ensure old cron.daily is absent\", \"when\": \"step|int == 1\", \"file\": {\"path\": \"/etc/cron.daily/containers-tmpwatch\", \"state\": \"absent\"}}], \"puppet_config\": {\"config_volume\": \"crond\", \"step_config\": \"include tripleo::profile::base::logging::logrotate\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCrondConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/logrotate-crond.json\": {\"command\": \"/usr/sbin/crond -s -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_4\": {\"logrotate_crond\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCrondImage\"]}, \"net\": \"none\", \"pid\": \"host\", \"privileged\": true, \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/logrotate-crond.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/crond:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers:/var/log/containers:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop logrotate container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"logrotate_crond\"], \"tripleo_delegate_to\": \"{{ groups['logrotate_crond'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/swift/swift-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Swift Proxy service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"SwiftHashSuffix\": {\"description\": \"A random string to be used as a salt when hashing to determine mappings in the ring.\", \"hidden\": true, \"type\": \"string\"}, \"SwiftHashPrefix\": {\"default\": \"\", \"description\": \"A random string to be used as an extra salt when hashing to determine mappings in the ring.\", \"hidden\": true, \"type\": \"string\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Swift common swift settings.\", \"value\": {\"service_name\": \"swift_base\", \"config_settings\": {\"swift::swift_hash_path_suffix\": {\"get_param\": \"SwiftHashSuffix\"}, \"swift::swift_hash_path_prefix\": {\"get_param\": \"SwiftHashPrefix\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/swift/swift-proxy-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized swift proxy service\\n\", \"parameters\": {\"ContainerSwiftProxyImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerSwiftConfigImage\": {\"description\": \"The container image to use for the swift config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"SwiftEncryptionEnabled\": {\"description\": \"Set to True to enable data-at-rest encryption in Swift\", \"default\": false, \"type\": \"boolean\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"SwiftPassword\": {\"description\": \"The password for the swift service account\", \"type\": \"string\", \"hidden\": true}, \"SwiftProxyNodeTimeout\": {\"default\": 60, \"description\": \"Timeout for requests going from swift-proxy to swift a/c/o services.\", \"type\": \"number\"}, \"SwiftProxyRecoverableNodeTimeout\": {\"default\": 30, \"description\": \"Timeout for GET/HEAD requests going from swift-proxy to swift a/c/o services.\", \"type\": \"number\"}, \"SwiftWorkers\": {\"default\": 0, \"description\": \"Number of workers for Swift service.\", \"type\": \"string\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionSwiftProxy\": {\"default\": \"overcloud-swift-proxy\", \"type\": \"string\"}, \"SwiftCeilometerPipelineEnabled\": {\"description\": \"Set to False to disable the swift proxy ceilometer pipeline.\", \"default\": false, \"type\": \"boolean\"}, \"SwiftCeilometerIgnoreProjects\": {\"default\": [\"service\"], \"description\": \"Comma-seperated list of project names to ignore.\", \"type\": \"comma_delimited_list\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}, \"SwiftCorsAllowedOrigin\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Indicate whether this resource may be shared with the domain received in the request \\\"origin\\\" header.\"}, \"EnforceSecureRbac\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC.\"}}, \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"swift_encryption_enabled\": {\"equals\": [{\"get_param\": \"SwiftEncryptionEnabled\"}, true]}, \"ceilometer_pipeline_enabled\": {\"equals\": [{\"get_param\": \"SwiftCeilometerPipelineEnabled\"}, true]}, \"use_tls_proxy\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"cors_allowed_origin_unset\": {\"equals\": [{\"get_param\": \"SwiftCorsAllowedOrigin\"}, \"\"]}, \"swift_workers_zero\": {\"equals\": [{\"get_param\": \"SwiftWorkers\"}, \"0\"]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"SwiftBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/swift/swift-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"TLSProxyBase\": {\"type\": \"OS::TripleO::Services::TLSProxyBase\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerSwiftProxyImage\": \"ContainerSwiftProxyImage\", \"ContainerSwiftConfigImage\": \"ContainerSwiftConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerSwiftProxyImage\": {\"get_param\": \"ContainerSwiftProxyImage\"}, \"ContainerSwiftConfigImage\": {\"get_param\": \"ContainerSwiftConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the swift proxy.\", \"value\": {\"service_name\": \"swift_proxy\", \"firewall_rules\": {\"122 swift proxy\": {\"dport\": [8080]}}, \"firewall_frontend_rules\": {\"100 swift_proxy_server_haproxy_frontend\": {\"dport\": [8080]}}, \"firewall_ssl_frontend_rules\": {\"100 swift_proxy_server_haproxy_frontend_ssl\": {\"dport\": [13808]}}, \"keystone_resources\": {\"swift\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"SwiftAdmin\", \"uri\"]}}, \"users\": {\"swift\": {\"password\": {\"get_param\": \"SwiftPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"object-store\", \"roles\": [\"swiftoperator\", \"ResellerAdmin\"]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionSwiftProxy\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"SwiftBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"config_settings\"]}, {\"if\": [\"cors_allowed_origin_unset\", {}, {\"swift::proxy::cors_allow_origin\": {\"get_param\": \"SwiftCorsAllowedOrigin\"}}]}, {\"swift::proxy::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"swift::proxy::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"swift::proxy::authtoken::password\": {\"get_param\": \"SwiftPassword\"}, \"swift::proxy::authtoken::project_name\": \"service\", \"swift::proxy::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"swift::proxy::authtoken::interface\": \"internal\", \"swift::proxy::s3token::auth_uri\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"swift::proxy::node_timeout\": {\"get_param\": \"SwiftProxyNodeTimeout\"}, \"swift::proxy::recoverable_node_timeout\": {\"get_param\": \"SwiftProxyRecoverableNodeTimeout\"}}, {\"if\": [\"swift_workers_zero\", {}, {\"swift::proxy::workers\": {\"get_param\": \"SwiftWorkers\"}}]}, {\"if\": [\"ceilometer_pipeline_enabled\", {\"swift::proxy::ceilometer::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"swift::proxy::ceilometer::password\": {\"get_param\": \"SwiftPassword\"}, \"swift::proxy::ceilometer::project_name\": \"service\", \"swift::proxy::ceilometer::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"swift::proxy::ceilometer::ignore_projects\": {\"get_param\": \"SwiftCeilometerIgnoreProjects\"}, \"swift::proxy::ceilometer::nonblocking_notify\": true, \"swift::proxy::ceilometer::rabbit_heartbeat_in_pthread\": false}, {}]}, {\"swift::proxy::staticweb::url_base\": {\"get_param\": [\"EndpointMap\", \"SwiftPublic\", \"uri_no_suffix\"]}, \"tripleo::profile::base::swift::proxy::ceilometer_enabled\": {\"get_param\": \"SwiftCeilometerPipelineEnabled\"}, \"swift::proxy::keystone::operator_roles\": [\"admin\", \"swiftoperator\", \"ResellerAdmin\"], \"swift::proxy::versioned_writes::allow_versioned_writes\": true}, {\"if\": [{\"get_param\": \"EnforceSecureRbac\"}, {\"swift::proxy::keystone::project_reader_roles\": [\"SwiftProjectReader\"]}, {\"swift::proxy::keystone::system_reader_roles\": [\"SwiftSystemReader\"]}]}, {\"if\": [\"swift_encryption_enabled\", {\"swift::keymaster::key_id\": \"test_id\", \"swift::keymaster::username\": \"swift\", \"swift::keymaster::password\": {\"get_param\": \"SwiftPassword\"}, \"swift::keymaster::project_name\": \"service\", \"swift::keymaster::project_domain_id\": \"default\", \"swift::keymaster::user_domain_id\": \"default\", \"swift::keymaster::auth_endpoint\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri\"]}}, {}]}, {\"swift::proxy::pipeline\": {\"list_concat\": [[\"catch_errors\", \"gatekeeper\", \"healthcheck\", \"proxy-logging\", \"cache\", \"listing_formats\", \"ratelimit\", \"bulk\", \"tempurl\", \"formpost\", \"authtoken\", \"s3api\", \"s3token\", \"keystone\", \"staticweb\", \"copy\", \"container_quotas\", \"account_quotas\", \"slo\", \"dlo\", \"versioned_writes\"], {\"if\": [\"ceilometer_pipeline_enabled\", [\"ceilometer\"], []]}, {\"if\": [\"swift_encryption_enabled\", [\"kms_keymaster\", \"encryption\"], []]}, [\"proxy-logging\", \"proxy-server\"]]}, \"swift::proxy::account_autocreate\": true, \"tripleo::profile::base::swift::proxy::tls_proxy_bind_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}}}, \"tripleo::profile::base::swift::proxy::tls_proxy_fqdn\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}}}, \"tripleo::profile::base::swift::proxy::tls_proxy_port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}, \"swift::proxy::port\": {\"get_param\": [\"EndpointMap\", \"SwiftInternal\", \"port\"]}, \"swift::proxy::proxy_local_net_ip\": {\"if\": [\"use_tls_proxy\", \"%{hiera('localhost_address')}\", {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftProxyNetwork\"]}}}}]}, \"swift::proxy::cache::tls_enabled\": {\"get_param\": \"MemcachedTLS\"}}]}, \"puppet_config\": {\"config_volume\": \"swift\", \"puppet_tags\": \"swift_config,swift_proxy_config,swift_keymaster_config\", \"step_config\": \"include tripleo::profile::base::swift::proxy\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/swift_proxy.json\": {\"command\": \"/usr/bin/swift-proxy-server /etc/swift/proxy-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_proxy_tls_proxy.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"container_config_scripts\": {\"create_swift_secret.sh\": {\"mode\": \"0700\", \"content\": \"#!/bin/bash\\nexport OS_PROJECT_DOMAIN_ID=$(crudini --get /etc/swift/keymaster.conf kms_keymaster project_domain_id)\\nexport OS_USER_DOMAIN_ID=$(crudini --get /etc/swift/keymaster.conf kms_keymaster user_domain_id)\\nexport OS_PROJECT_NAME=$(crudini --get /etc/swift/keymaster.conf kms_keymaster project_name)\\nexport OS_USERNAME=$(crudini --get /etc/swift/keymaster.conf kms_keymaster username)\\nexport OS_PASSWORD=$(crudini --get /etc/swift/keymaster.conf kms_keymaster password)\\nexport OS_AUTH_URL=$(crudini --get /etc/swift/keymaster.conf kms_keymaster auth_endpoint)\\nexport OS_AUTH_TYPE=password\\nexport OS_IDENTITY_API_VERSION=3\\n\\necho \\\"Check if secret already exists\\\"\\nsecret_href=$(openstack secret list --name swift_root_secret_uuid)\\nrc=$?\\nif [[ $rc != 0 ]]; then\\n  echo \\\"Failed to check secrets, check if Barbican in enabled and responding properly\\\"\\n  exit $rc;\\nfi\\nif [ -z \\\"$secret_href\\\" ]; then\\n  echo \\\"Create new secret\\\"\\n  order_href=$(openstack secret order create --name swift_root_secret_uuid --payload-content-type=\\\"application/octet-stream\\\" --algorithm aes --bit-length 256 --mode ctr key -f value -c \\\"Order href\\\")\\nfi\\n\"}, \"set_swift_keymaster_key_id.sh\": {\"mode\": \"0700\", \"content\": \"#!/bin/bash\\nexport OS_PROJECT_DOMAIN_ID=$(crudini --get /etc/swift/keymaster.conf kms_keymaster project_domain_id)\\nexport OS_USER_DOMAIN_ID=$(crudini --get /etc/swift/keymaster.conf kms_keymaster user_domain_id)\\nexport OS_PROJECT_NAME=$(crudini --get /etc/swift/keymaster.conf kms_keymaster project_name)\\nexport OS_USERNAME=$(crudini --get /etc/swift/keymaster.conf kms_keymaster username)\\nexport OS_PASSWORD=$(crudini --get /etc/swift/keymaster.conf kms_keymaster password)\\nexport OS_AUTH_URL=$(crudini --get /etc/swift/keymaster.conf kms_keymaster auth_endpoint)\\nexport OS_AUTH_TYPE=password\\nexport OS_IDENTITY_API_VERSION=3\\necho \\\"retrieve key_id\\\"\\nloop_wait=2\\nfor i in {0..5}; do\\n  #TODO update uuid from mistral here too\\n  secret_href=$(openstack secret list --name swift_root_secret_uuid)\\n  if [ \\\"$secret_href\\\" ]; then\\n    echo \\\"set key_id in keymaster.conf\\\"\\n    secret_href=$(openstack secret list --name swift_root_secret_uuid -f value -c \\\"Secret href\\\")\\n    crudini --set /etc/swift/keymaster.conf kms_keymaster key_id ${secret_href##*/}\\n    exit 0\\n  else\\n    echo \\\"no key, wait for $loop_wait and check again\\\"\\n    sleep $loop_wait\\n    ((loop_wait++))\\n  fi\\ndone\\necho \\\"Failed to set secret in keymaster.conf, check if Barbican is enabled and responding properly\\\"\\nexit 1\\n\"}}, \"docker_config\": {\"step_4\": {\"map_merge\": [{\"if\": [\"swift_encryption_enabled\", {\"create_swift_secret\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftProxyImage\"]}, \"net\": \"host\", \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/swift/etc/swift:/etc/swift:ro\", \"/var/lib/container-config-scripts/create_swift_secret.sh:/create_swift_secret.sh:ro\"]]}, \"user\": \"root\", \"command\": \"/usr/bin/bootstrap_host_exec swift_proxy /create_swift_secret.sh\"}}, {}]}, {\"if\": [\"swift_encryption_enabled\", {\"set_swift_secret\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftProxyImage\"]}, \"net\": \"host\", \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/swift/etc/swift:/etc/swift:rw,z\", \"/var/lib/container-config-scripts/set_swift_keymaster_key_id.sh:/set_swift_keymaster_key_id.sh:ro\"]]}, \"user\": \"root\", \"command\": \"/set_swift_keymaster_key_id.sh\", \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, {}]}, {\"swift_proxy\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftProxyImage\"]}, \"start_order\": 2, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"if\": [\"internal_tls_enabled\", {\"swift_proxy_tls_proxy\": {\"start_order\": 3, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftProxyImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_proxy_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {}]}]}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/srv/node\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/log/swift\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/log/containers/swift\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"deploy_steps_tasks\": [{\"name\": \"Configure rsyslog for swift\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Check if rsyslog exists\", \"shell\": \"systemctl is-active rsyslog\", \"register\": \"swift_rsyslog_config\"}, {\"name\": \"Forward logging to swift.log file\", \"copy\": {\"content\": \"# Fix for https://bugs.launchpad.net/tripleo/+bug/1776180\\nlocal2.*                 /var/log/containers/swift/swift.log\\n&                        stop\\n\", \"dest\": \"/etc/rsyslog.d/openstack-swift.conf\"}, \"register\": \"swift_logconfig\", \"when\": [\"swift_rsyslog_config is defined\", \"swift_rsyslog_config.rc == 0\"]}, {\"name\": \"Restart rsyslogd service after logging conf change\", \"service\": {\"name\": \"rsyslog\", \"state\": \"restarted\"}, \"when\": [\"swift_logconfig is defined\", \"swift_logconfig is changed\"]}]}, {\"name\": \"Run kolla_set_configs to copy ring files\", \"when\": \"step|int == 5\", \"shell\": \"{{ container_cli }} exec -u root {{ item }} /usr/local/bin/kolla_set_configs \", \"become\": true, \"register\": \"kolla_set_configs_result\", \"failed_when\": [\"kolla_set_configs_result.rc is defined\", \"kolla_set_configs_result.rc not in [0, 125]\"], \"with_items\": [\"swift_proxy\"]}], \"update_tasks\": [{\"name\": \"Check swift containers log folder/symlink exists\", \"stat\": {\"path\": \"/var/log/containers/swift\"}, \"register\": \"swift_log_link\"}, {\"name\": \"Delete if symlink\", \"file\": {\"path\": \"/var/log/containers/swift\", \"state\": \"absent\"}, \"when\": \"swift_log_link.stat.islnk is defined and swift_log_link.stat.islnk\"}], \"metadata_settings\": {\"get_attr\": [\"TLSProxyBase\", \"role_data\", \"metadata_settings\"]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/swift/swift-storage-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Swift Storage services.\\n\", \"parameters\": {\"ContainerSwiftProxyImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerSwiftAccountImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerSwiftContainerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerSwiftObjectImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerSwiftConfigImage\": {\"description\": \"The container image to use for the swift config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"SwiftRawDisks\": {\"default\": {}, \"description\": \"A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})\", \"type\": \"json\"}, \"SwiftReplicas\": {\"type\": \"number\", \"default\": 3, \"description\": \"How many replicas to use in the swift rings.\"}, \"SwiftUseLocalDir\": {\"default\": true, \"description\": \"Use a local directory for Swift storage services when building rings\", \"type\": \"boolean\"}, \"SwiftContainerSharderEnabled\": {\"description\": \"Set to True to enable Swift container sharder service\", \"default\": false, \"type\": \"boolean\"}, \"SwiftMountCheck\": {\"default\": false, \"description\": \"Value of mount_check in Swift account/container/object -server.conf\", \"type\": \"boolean\"}, \"SwiftUseNodeDataLookup\": {\"default\": false, \"description\": \"Use NodeDataLookup for disk devices in order to use persistent naming\", \"type\": \"boolean\"}, \"SwiftAccountWorkers\": {\"default\": 0, \"description\": \"Number of workers for Swift account service.\", \"type\": \"string\"}, \"SwiftContainerWorkers\": {\"default\": 0, \"description\": \"Number of workers for Swift account service.\", \"type\": \"string\"}, \"SwiftObjectWorkers\": {\"default\": 0, \"description\": \"Number of workers for Swift account service.\", \"type\": \"string\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}, \"ControllerEnableSwiftStorage\": {\"default\": true, \"description\": \"Whether to enable Swift Storage on the Controller\", \"type\": \"boolean\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"Do not use deprecated params, they will be removed.\", \"parameters\": [\"ControllerEnableSwiftStorage\"]}], \"conditions\": {\"single_replica_mode\": {\"equals\": [{\"get_param\": \"SwiftReplicas\"}, 1]}, \"swift_container_sharder_enabled\": {\"equals\": [{\"get_param\": \"SwiftContainerSharderEnabled\"}, true]}, \"swift_mount_check\": {\"or\": [{\"equals\": [{\"get_param\": \"SwiftMountCheck\"}, true]}, {\"not\": {\"equals\": [{\"get_param\": \"SwiftRawDisks\"}, {}]}}]}, \"account_workers_zero\": {\"equals\": [{\"get_param\": \"SwiftAccountWorkers\"}, \"0\"]}, \"container_workers_zero\": {\"equals\": [{\"get_param\": \"SwiftContainerWorkers\"}, \"0\"]}, \"object_workers_zero\": {\"equals\": [{\"get_param\": \"SwiftObjectWorkers\"}, \"0\"]}, \"use_node_data_lookup\": {\"equals\": [{\"get_param\": \"SwiftUseNodeDataLookup\"}, true]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"SwiftBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/swift/swift-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerSwiftProxyImage\": \"ContainerSwiftProxyImage\", \"ContainerSwiftAccountImage\": \"ContainerSwiftAccountImage\", \"ContainerSwiftContainerImage\": \"ContainerSwiftContainerImage\", \"ContainerSwiftObjectImage\": \"ContainerSwiftObjectImage\", \"ContainerSwiftConfigImage\": \"ContainerSwiftConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerSwiftProxyImage\": {\"get_param\": \"ContainerSwiftProxyImage\"}, \"ContainerSwiftAccountImage\": {\"get_param\": \"ContainerSwiftAccountImage\"}, \"ContainerSwiftContainerImage\": {\"get_param\": \"ContainerSwiftContainerImage\"}, \"ContainerSwiftObjectImage\": {\"get_param\": \"ContainerSwiftObjectImage\"}, \"ContainerSwiftConfigImage\": {\"get_param\": \"ContainerSwiftConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the swift storage services.\", \"value\": {\"service_name\": \"swift_storage\", \"firewall_rules\": {\"123 swift storage\": {\"dport\": [873, 6000, 6001, 6002]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"SwiftBase\", \"role_data\", \"config_settings\"]}, {\"swift::storage::all::mount_check\": false, \"tripleo::profile::base::swift::storage::use_local_dir\": {\"get_param\": \"SwiftUseLocalDir\"}, \"swift::storage::all::incoming_chmod\": \"Du=rwx,g=rx,o=rx,Fu=rw,g=r,o=r\", \"swift::storage::all::outgoing_chmod\": \"Du=rwx,g=rx,o=rx,Fu=rw,g=r,o=r\", \"swift::storage::all::account_port\": 6002, \"swift::storage::all::container_port\": 6001, \"swift::storage::all::object_port\": 6000, \"swift::storage::all::object_pipeline\": [\"healthcheck\", \"recon\", \"object-server\"], \"swift::storage::all::container_pipeline\": [\"healthcheck\", \"recon\", \"container-server\"], \"swift::storage::all::account_pipeline\": [\"healthcheck\", \"recon\", \"account-server\"]}, {\"if\": [\"use_node_data_lookup\", {}, {\"swift::storage::disks::args\": {\"get_param\": \"SwiftRawDisks\"}}]}, {\"swift::storage::all::storage_local_net_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"SwiftStorageNetwork\"]}}}}, \"rsync::server::pid_file\": \"UNSET\", \"swift::objectexpirer::cache_tls_enabled\": {\"get_param\": \"MemcachedTLS\"}}, {\"if\": [\"account_workers_zero\", {}, {\"swift::storage::all::account_server_workers\": {\"get_param\": \"SwiftAccountWorkers\"}}]}, {\"if\": [\"container_workers_zero\", {}, {\"swift::storage::all::container_server_workers\": {\"get_param\": \"SwiftContainerWorkers\"}}]}, {\"if\": [\"object_workers_zero\", {}, {\"swift::storage::all::object_server_workers\": {\"get_param\": \"SwiftObjectWorkers\"}}]}]}, \"service_config_settings\": {}, \"puppet_config\": {\"config_volume\": \"swift\", \"puppet_tags\": \"swift_config,swift_container_config,swift_container_sync_realms_config,swift_account_config,swift_object_config,swift_object_expirer_config,rsync::server\", \"step_config\": {\"list_join\": [\"\\n\", [\"class xinetd() {}\", \"define xinetd::service($bind='',$port='',$server='',$server_args='') {}\", \"noop_resource('service')\", \"include tripleo::profile::base::swift::storage\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/swift_account_auditor.json\": {\"command\": \"/usr/bin/swift-account-auditor /etc/swift/account-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_account_reaper.json\": {\"command\": \"/usr/bin/swift-account-reaper /etc/swift/account-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_account_replicator.json\": {\"command\": \"/usr/bin/swift-account-replicator /etc/swift/account-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_account_server.json\": {\"command\": \"/usr/bin/swift-account-server /etc/swift/account-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_container_auditor.json\": {\"command\": \"/usr/bin/swift-container-auditor /etc/swift/container-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_container_replicator.json\": {\"command\": \"/usr/bin/swift-container-replicator /etc/swift/container-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_container_updater.json\": {\"command\": \"/usr/bin/swift-container-updater /etc/swift/container-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_container_server.json\": {\"command\": \"/usr/bin/swift-container-server /etc/swift/container-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_container_sharder.json\": {\"command\": \"/usr/bin/swift-container-sharder /etc/swift/container-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_object_auditor.json\": {\"command\": \"/usr/bin/swift-object-auditor /etc/swift/object-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_object_expirer.json\": {\"command\": \"/usr/bin/swift-object-expirer /etc/swift/object-expirer.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_object_replicator.json\": {\"command\": \"/usr/bin/swift-object-replicator /etc/swift/object-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_object_updater.json\": {\"command\": \"/usr/bin/swift-object-updater /etc/swift/object-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/swift_object_server.json\": {\"command\": \"/usr/bin/swift-object-server /etc/swift/object-server.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/cache/swift\", \"owner\": \"swift:swift\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/swift_rsync.json\": {\"command\": \"/usr/bin/rsync --daemon --no-detach --config=/etc/rsyncd.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_3\": {\"swift_setup_srv\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftAccountImage\"]}, \"net\": \"none\", \"user\": \"root\", \"command\": [\"find\", \"/srv/node\", \"-maxdepth\", \"1\", \"-type\", \"d\", \"-exec\", \"chown\", \"swift:\", \"{}\", \";\"], \"volumes\": [\"/srv/node:/srv/node:z\"], \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"map_merge\": [{\"if\": [\"single_replica_mode\", {}, {\"swift_account_auditor\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftAccountImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_account_auditor.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift:z\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_account_replicator\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftAccountImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_account_replicator.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_container_auditor\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftContainerImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_container_auditor.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_container_replicator\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftContainerImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_container_replicator.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_object_auditor\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftObjectImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_object_auditor.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_object_replicator\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftObjectImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_object_replicator.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_rsync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftObjectImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"privileged\": false, \"cap_add\": [\"NET_BIND_SERVICE\"], \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_rsync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}, {\"swift_account_reaper\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftAccountImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_account_reaper.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift:z\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_account_server\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftAccountImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_account_server.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_container_updater\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftContainerImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_container_updater.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_container_server\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftContainerImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_container_server.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_object_expirer\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftProxyImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_object_expirer.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_object_updater\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftObjectImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_object_updater.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"swift_object_server\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftObjectImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_object_server.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"if\": [\"swift_container_sharder_enabled\", {\"swift_container_sharder\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftContainerImage\"]}, \"net\": \"host\", \"user\": \"swift\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/swift_container_sharder.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/swift:/var/lib/kolla/config_files/src:ro\", \"/srv/node:/srv/node\", \"/dev:/dev\", \"/var/cache/swift:/var/cache/swift\", \"/var/log/containers/swift:/var/log/swift:z\"]]}}}, {}]}]}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/srv/node\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/cache/swift\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/log/containers/swift\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"Set swift_use_local_disks fact\", \"set_fact\": {\"swift_use_local_disks\": {\"get_param\": \"SwiftUseLocalDir\"}}}, {\"name\": \"Set use_node_data_lookup fact\", \"set_fact\": {\"use_node_data_lookup\": {\"get_param\": \"SwiftUseNodeDataLookup\"}}}, {\"name\": \"Create Swift d1 directory if needed\", \"file\": {\"path\": \"/srv/node/d1\", \"state\": \"directory\"}, \"when\": \"swift_use_local_disks\"}, {\"name\": \"Set fact for SwiftRawDisks\", \"set_fact\": {\"swift_raw_disks\": {\"get_param\": \"SwiftRawDisks\"}}, \"when\": \"not use_node_data_lookup|bool\"}, {\"name\": \"Get hiera swift::storage::disks::args\", \"shell\": \"hiera -c /etc/puppet/hiera.yaml swift::storage::disks::args | sed =e 's/=>/:/g'\", \"register\": \"hiera_output\", \"when\": \"use_node_data_lookup|bool\"}, {\"name\": \"Set fact for swift_raw_disks\", \"set_fact\": {\"swift_raw_disks\": \"{{ hiera_output.stdout | from_json }}\"}, \"when\": \"use_node_data_lookup|bool\"}, {\"name\": \"Format SwiftRawDisks\", \"community.general.filesystem\": {\"fstype\": \"xfs\", \"dev\": \"{{ swift_raw_disks[item]['base_dir']|default('/dev') }}/{{ item }}\", \"opts\": \"-f -i size=1024\"}, \"with_items\": \"{{ swift_raw_disks }}\", \"when\": \"swift_raw_disks|length > 0\"}, {\"name\": \"Refresh facts if SwiftRawDisks is set to get uuids if newly created partitions\", \"setup\": {\"gather_subset\": [\"!all\", \"!min\", \"hardware\"], \"filter\": \"ansible_device_links\"}, \"when\": \"swift_raw_disks|length > 0\"}, {\"name\": \"Mount devices defined in SwiftRawDisks\", \"mount\": {\"name\": \"/srv/node/{{ item }}\", \"src\": \"{% if lsblk.results['uuids'][item] is defined %}UUID={{ ansible_facts['device_links']['uuids'][item][0] }}{% else %}{{ swift_raw_disks[item]['base_dir']|default('/dev') }}/{{ item }}{% endif %}\", \"fstype\": \"xfs\", \"opts\": \"noatime\", \"state\": \"mounted\"}, \"with_items\": \"{{ swift_raw_disks }}\", \"when\": \"swift_raw_disks|length > 0\"}], \"deploy_steps_tasks\": [{\"name\": \"Configure rsyslog for swift\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Check if rsyslog exists\", \"shell\": \"systemctl is-active rsyslog\", \"register\": \"swift_rsyslog_config\"}, {\"name\": \"Forward logging to swift.log file\", \"copy\": {\"content\": \"# Fix for https://bugs.launchpad.net/tripleo/+bug/1776180\\nlocal2.*                 /var/log/containers/swift/swift.log\\n&                        stop\\n\", \"dest\": \"/etc/rsyslog.d/openstack-swift.conf\"}, \"register\": \"swift_logconfig\", \"when\": [\"swift_rsyslog_config is defined\", \"swift_rsyslog_config.rc == 0\"]}, {\"name\": \"Restart rsyslogd service after logging conf change\", \"service\": {\"name\": \"rsyslog\", \"state\": \"restarted\"}, \"when\": [\"swift_logconfig is defined\", \"swift_logconfig is changed\"]}]}, {\"name\": \"Run kolla_set_configs to copy ring files\", \"when\": \"step|int == 5\", \"shell\": \"{{ container_cli }} exec -u root {{ item }} /usr/local/bin/kolla_set_configs\", \"become\": true, \"register\": \"kolla_set_configs_result\", \"failed_when\": [\"kolla_set_configs_result.rc is defined\", \"kolla_set_configs_result.rc not in [0, 125]\"], \"with_items\": [\"swift_account_auditor\", \"swift_account_reaper\", \"swift_account_replicator\", \"swift_account_server\", \"swift_container_auditor\", \"swift_container_replicator\", \"swift_container_server\", \"swift_container_updater\", \"swift_object_auditor\", \"swift_object_expirer\", \"swift_object_replicator\", \"swift_object_server\", \"swift_object_updater\"]}], \"update_tasks\": [{\"name\": \"Check swift containers log folder/symlink exists\", \"stat\": {\"path\": \"/var/log/containers/swift\"}, \"register\": \"swift_log_link\"}, {\"name\": \"Delete if symlink\", \"file\": {\"path\": \"/var/log/containers/swift\", \"state\": \"absent\"}, \"when\": \"swift_log_link.stat.islnk is defined and swift_log_link.stat.islnk\"}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/swift/swift-ringbuilder-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Swift Ringbuilder\\n\", \"parameters\": {\"ContainerSwiftConfigImage\": {\"description\": \"The container image to use for the swift config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"SwiftMinPartHours\": {\"type\": \"number\", \"default\": 1, \"description\": \"The minimum time (in hours) before a partition in a ring can be moved following a rebalance.\"}, \"SwiftPartPower\": {\"default\": 10, \"description\": \"Partition Power to use when building Swift rings\", \"type\": \"number\"}, \"SwiftRingBuild\": {\"default\": true, \"description\": \"Whether to manage Swift rings or not\", \"type\": \"boolean\"}, \"SwiftReplicas\": {\"type\": \"number\", \"default\": 3, \"description\": \"How many replicas to use in the swift rings.\"}, \"SwiftRawDisks\": {\"default\": {}, \"description\": \"A hash of additional raw devices to use as Swift backend (eg. {sdb: {}})\", \"type\": \"json\"}, \"SwiftUseLocalDir\": {\"default\": true, \"description\": \"Use a local directory for Swift storage services when building rings\", \"type\": \"boolean\"}, \"SwiftUseNodeDataLookup\": {\"default\": false, \"description\": \"Use NodeDataLookup for disk devices in order to use persistent naming\", \"type\": \"boolean\"}, \"SwiftRingGetTempurl\": {\"default\": \"\", \"description\": \"A temporary Swift URL to download rings from.\", \"type\": \"string\"}, \"SwiftRingPutTempurl\": {\"default\": \"\", \"description\": \"A temporary Swift URL to upload rings to.\", \"type\": \"string\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}}, \"conditions\": {\"swift_use_local_dir\": {\"and\": [{\"equals\": [{\"get_param\": \"SwiftUseLocalDir\"}, true]}, {\"equals\": [{\"get_param\": \"SwiftRawDisks\"}, {}]}]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerSwiftConfigImage\": \"ContainerSwiftConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerSwiftConfigImage\": {\"get_param\": \"ContainerSwiftConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for Swift Ringbuilder configuration in containers.\", \"value\": {\"service_name\": \"swift_ringbuilder\", \"config_settings\": {\"map_merge\": [{\"tripleo::profile::base::swift::ringbuilder::skip_consistency_check\": true, \"tripleo::profile::base::swift::ringbuilder::swift_ring_get_tempurl\": {\"get_param\": \"SwiftRingGetTempurl\"}, \"tripleo::profile::base::swift::ringbuilder::swift_ring_put_tempurl\": {\"get_param\": \"SwiftRingPutTempurl\"}, \"tripleo::profile::base::swift::ringbuilder::build_ring\": {\"get_param\": \"SwiftRingBuild\"}, \"tripleo::profile::base::swift::ringbuilder::replicas\": {\"get_param\": \"SwiftReplicas\"}, \"tripleo::profile::base::swift::ringbuilder::part_power\": {\"get_param\": \"SwiftPartPower\"}, \"tripleo::profile::base::swift::ringbuilder::min_part_hours\": {\"get_param\": \"SwiftMinPartHours\"}, \"tripleo::profile::base::swift::ringbuilder::raw_disk_prefix\": \"r1z1-\"}, {\"if\": [{\"get_param\": \"SwiftUseNodeDataLookup\"}, {}, {\"tripleo::profile::base::swift::ringbuilder::raw_disks\": {\"list_concat\": [{\"if\": [\"swift_use_local_dir\", [\":%PORT%/d1\"]]}, {\"repeat\": {\"template\": \":%PORT%/DEVICE\", \"for_each\": {\"DEVICE\": {\"get_param\": \"SwiftRawDisks\"}}}}]}}]}]}, \"service_config_settings\": {}, \"puppet_config\": {\"config_volume\": \"swift_ringbuilder\", \"puppet_tags\": \"swift_config,exec,fetch_swift_ring_tarball,extract_swift_ring_tarball,ring_object_device,swift::ringbuilder::create,tripleo::profile::base::swift::add_devices,swift::ringbuilder::rebalance,create_swift_ring_tarball,upload_swift_ring_tarball\", \"step_config\": \"include tripleo::profile::base::swift::ringbuilder\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftConfigImage\"]}}, \"kolla_config\": {}, \"docker_config\": {\"step_3\": {\"swift_copy_rings\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerSwiftConfigImage\"]}, \"net\": \"none\", \"user\": \"root\", \"detach\": false, \"command\": [\"/bin/bash\", \"-c\", \"cp -v -dR --preserve -t /etc/swift /swift_ringbuilder/etc/swift/*.gz /swift_ringbuilder/etc/swift/*.builder /swift_ringbuilder/etc/swift/backups\"], \"volumes\": [\"/var/lib/config-data/puppet-generated/swift/etc/swift:/etc/swift:rw,z\", \"/var/lib/config-data/puppet-generated/swift_ringbuilder:/swift_ringbuilder:ro\"], \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/snmp/snmp-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"SNMP client configured with Puppet, to facilitate Ceilometer Hardware monitoring in the undercloud. This service is required to enable hardware monitoring.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"SnmpdReadonlyUserName\": {\"default\": \"ro_snmp_user\", \"description\": \"The user name for SNMPd with readonly rights running on all Overcloud nodes\", \"type\": \"string\"}, \"SnmpdReadonlyUserPassword\": {\"description\": \"The user password for SNMPd with readonly rights running on all Overcloud nodes\", \"type\": \"string\", \"hidden\": true}, \"SnmpdBindHost\": {\"description\": \"An array of bind host addresses on which SNMP daemon will listen.\", \"type\": \"comma_delimited_list\", \"default\": [\"udp:161\", \"udp6:[::1]:161\"]}, \"SnmpdOptions\": {\"description\": \"A string containing the commandline options passed to snmpd\", \"type\": \"string\", \"default\": \"-LS0-5d\"}, \"SnmpdIpSubnet\": {\"default\": \"\", \"description\": \"IP address/subnet on the snmpd network. If empty (default), SnmpdNetwork will be taken.\", \"type\": \"string\"}}, \"conditions\": {\"snmpd_network_unset\": {\"equals\": [{\"get_param\": \"SnmpdIpSubnet\"}, \"\"]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the SNMP services\", \"value\": {\"service_name\": \"snmp\", \"firewall_rules\": {\"if\": [\"snmpd_network_unset\", {\"map_merge\": {\"repeat\": {\"for_each\": {\"<%net_cidr%>\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"SnmpdNetwork\"]}]}}, \"template\": {\"124 snmp <%net_cidr%>\": {\"dport\": 161, \"proto\": \"udp\", \"source\": \"<%net_cidr%>\"}}}}}, {\"124 snmp\": {\"dport\": 161, \"proto\": \"udp\", \"source\": {\"get_param\": \"SnmpdIpSubnet\"}}}]}, \"config_settings\": {\"tripleo::profile::base::snmp::snmpd_user\": {\"get_param\": \"SnmpdReadonlyUserName\"}, \"tripleo::profile::base::snmp::snmpd_password\": {\"get_param\": \"SnmpdReadonlyUserPassword\"}, \"snmp::agentaddress\": {\"get_param\": \"SnmpdBindHost\"}, \"snmp::snmpd_options\": {\"get_param\": \"SnmpdOptions\"}}, \"step_config\": \"include tripleo::profile::base::snmp\\n\", \"upgrade_tasks\": [{\"when\": \"step|int == 0\", \"block\": [{\"name\": \"Check if snmpd is enabled\", \"command\": \"systemctl is-enabled --quiet snmpd\", \"failed_when\": false, \"register\": \"snmpd_enabled_result\"}, {\"name\": \"Set fact snmpd_enabled\", \"set_fact\": {\"snmpd_enabled\": \"{{ snmpd_enabled_result.rc == 0 }}\"}}]}, {\"name\": \"Stop snmp service\", \"when\": [\"step|int == 1\", \"snmpd_enabled|bool\"], \"service\": \"name=snmpd state=stopped\"}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/time/timezone-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Composable Timezone service\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"TimeZone\": {\"default\": \"UTC\", \"description\": \"The timezone to be set on the overcloud.\", \"type\": \"string\"}}, \"outputs\": {\"role_data\": {\"description\": \"Timezone role using composable services.\", \"value\": {\"service_name\": \"timezone\", \"host_prep_tasks\": [{\"name\": \"Run timezone role\", \"include_role\": {\"name\": \"tripleo_timezone\"}, \"vars\": {\"tripleo_timezone\": {\"get_param\": \"TimeZone\"}}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/horizon/horizon-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Horizon service\\n\", \"parameters\": {\"ContainerHorizonImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerHorizonConfigImage\": {\"description\": \"The container image to use for the horizon config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"HorizonDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Horizon service.\", \"type\": \"boolean\"}, \"HorizonAllowedHosts\": {\"default\": \"*\", \"description\": \"A list of IP/Hostname for the server Horizon is running on. Used for header checks.\", \"type\": \"comma_delimited_list\"}, \"HorizonPasswordValidator\": {\"description\": \"Regex for password validation\", \"type\": \"string\", \"default\": \"\"}, \"HorizonPasswordValidatorHelp\": {\"description\": \"Help text for password validation\", \"type\": \"string\", \"default\": \"\"}, \"HorizonSecret\": {\"description\": \"Secret key for Django\", \"type\": \"string\", \"hidden\": true, \"default\": \"\"}, \"HorizonSecureCookies\": {\"description\": \"Set CSRF_COOKIE_SECURE / SESSION_COOKIE_SECURE in Horizon\", \"type\": \"boolean\", \"default\": false}, \"HorizonSessionTimeout\": {\"description\": \"Set session timeout for horizon in seconds\", \"type\": \"number\", \"default\": 1800}, \"MemcachedIPv6\": {\"default\": false, \"description\": \"Enable IPv6 features in Memcached.\", \"type\": \"boolean\"}, \"MonitoringSubscriptionHorizon\": {\"default\": \"overcloud-horizon\", \"type\": \"string\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"HorizonVhostExtraParams\": {\"default\": {\"add_listen\": true, \"priority\": 10, \"access_log_format\": \"%a %l %u %t \\\\\\\"%r\\\\\\\" %>s %b \\\\\\\"%%{}{Referer}i\\\\\\\" \\\\\\\"%%{}{User-Agent}i\\\\\\\"\", \"options\": [\"FollowSymLinks\", \"MultiViews\"]}, \"description\": \"Extra parameters for Horizon vhost configuration\", \"type\": \"json\"}, \"HorizonCustomizationModule\": {\"default\": \"\", \"description\": \"Horizon has a global overrides mechanism available to perform customizations\", \"type\": \"string\"}, \"HorizonHelpURL\": {\"default\": \"http://docs.openstack.org\", \"description\": \"On top of dashboard there is a Help button. This button could be used to re-direct user to vendor documentation or dedicated help portal.\", \"type\": \"string\"}, \"TimeZone\": {\"default\": \"UTC\", \"description\": \"The timezone to be set on the overcloud.\", \"type\": \"string\"}, \"WebSSOEnable\": {\"default\": false, \"type\": \"boolean\", \"description\": \"Enable support for Web Single Sign-On\"}, \"WebSSOInitialChoice\": {\"default\": \"OIDC\", \"type\": \"string\", \"description\": \"The initial authentication choice to select by default\"}, \"WebSSOChoicesHideKeystone\": {\"default\": false, \"type\": \"boolean\", \"description\": \"Hide Keystone crednetials login when WebSSO is enabled.\"}, \"WebSSOChoices\": {\"default\": [[\"OIDC\", \"OpenID Connect\"]], \"type\": \"json\", \"description\": \"Specifies the list of SSO authentication choices to present. Each item is a list of an SSO choice identifier and a display message.\"}, \"WebSSOIDPMapping\": {\"default\": {\"OIDC\": [\"myidp\", \"openid\"]}, \"type\": \"json\", \"description\": \"Specifies a mapping from SSO authentication choice to identity provider and protocol.  The identity provider and protocol names must match the resources defined in keystone.\"}, \"HorizonDomainChoices\": {\"default\": [], \"type\": \"json\", \"description\": \"Specifies available domains to choose from. We expect an array of hashes, and the hashes should have two items each (name, display) containing Keystone domain name and a human-readable description of the domain respectively.\"}, \"HorizonLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.horizon\", \"file\": \"/var/log/containers/horizon/horizon.log\"}}, \"HorizonHstsHeaderValue\": {\"default\": [], \"description\": \"Enables HTTP Strict-Transport-Security header in response.\", \"type\": \"comma_delimited_list\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"MemcachedIPv6\"]}], \"conditions\": {\"horizon_domain_choices_set\": {\"not\": {\"equals\": [{\"get_param\": \"HorizonDomainChoices\"}, []]}}, \"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"HorizonNetwork\"]}]}, 6]}, \"horizon_logger_debug\": {\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"HorizonDebug\"}]}, \"horizon_hsts_header_value_set\": {\"not\": {\"equals\": [{\"get_param\": \"HorizonHstsHeaderValue\"}, []]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHorizonImage\": \"ContainerHorizonImage\", \"ContainerHorizonConfigImage\": \"ContainerHorizonConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHorizonImage\": {\"get_param\": \"ContainerHorizonImage\"}, \"ContainerHorizonConfigImage\": {\"get_param\": \"ContainerHorizonConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Horizon API role.\", \"value\": {\"service_name\": \"horizon\", \"firewall_rules\": {\"126 horizon\": {\"dport\": [{\"if\": [{\"get_param\": \"EnableInternalTLS\"}, 443, 80]}]}}, \"firewall_frontend_rules\": {\"100 horizon_haproxy_frontend\": {\"dport\": [80]}}, \"firewall_ssl_frontend_rules\": {\"100 horizon_haproxy_frontend_ssl\": {\"dport\": [443]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionHorizon\"}, \"config_settings\": {\"map_merge\": [{\"horizon::allowed_hosts\": {\"get_param\": \"HorizonAllowedHosts\"}, \"horizon::enable_secure_proxy_ssl_header\": true, \"horizon::secure_proxy_addr_header\": \"HTTP_X_FORWARDED_FOR\", \"horizon::disable_password_reveal\": true, \"horizon::enforce_password_check\": true, \"horizon::disallow_iframe_embed\": true, \"horizon::cache_backend\": \"django.core.cache.backends.memcached.MemcachedCache\", \"horizon::django_session_engine\": \"django.contrib.sessions.backends.cache\", \"horizon::vhost_extra_params\": {\"get_param\": \"HorizonVhostExtraParams\"}, \"horizon::bind_address\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HorizonNetwork\"]}}}}, \"horizon::keystone_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Public\", \"uri\"]}, \"horizon::password_validator\": {\"get_param\": [\"HorizonPasswordValidator\"]}, \"horizon::password_validator_help\": {\"get_param\": [\"HorizonPasswordValidatorHelp\"]}, \"horizon::secret_key\": {\"get_param\": \"HorizonSecret\"}, \"horizon::secure_cookies\": {\"get_param\": [\"HorizonSecureCookies\"]}, \"horizon::session_timeout\": {\"get_param\": \"HorizonSessionTimeout\"}, \"memcached_ipv6\": {\"if\": [\"is_ipv6\", true, false]}, \"horizon::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"HorizonNetwork\"]}}}}, \"horizon::listen_ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"horizon::customization_module\": {\"get_param\": \"HorizonCustomizationModule\"}, \"horizon::timezone\": {\"get_param\": \"TimeZone\"}, \"horizon::file_upload_temp_dir\": \"/var/tmp\", \"horizon::help_url\": {\"get_param\": \"HorizonHelpURL\"}, \"horizon::enable_user_pass\": \"UNSET\"}, {\"if\": [{\"get_param\": \"WebSSOEnable\"}, {\"horizon::websso_enabled\": {\"get_param\": \"WebSSOEnable\"}, \"horizon::websso_initial_choice\": {\"get_param\": \"WebSSOInitialChoice\"}, \"horizon::websso_choices\": {\"get_param\": \"WebSSOChoices\"}, \"horizon::websso_idp_mapping\": {\"get_param\": \"WebSSOIDPMapping\"}, \"horizon::websso_choices_hide_keystone\": {\"get_param\": \"WebSSOChoicesHideKeystone\"}}]}, {\"if\": [{\"get_param\": \"HorizonDebug\"}, {\"horizon::django_debug\": true}, {\"horizon::django_debug\": {\"get_param\": \"Debug\"}}]}, {\"if\": [\"horizon_logger_debug\", {\"horizon::log_level\": \"DEBUG\"}]}, {\"if\": [\"horizon_domain_choices_set\", {\"horizon::keystone_domain_choices\": {\"get_param\": \"HorizonDomainChoices\"}}]}]}, \"ansible_group_vars\": {\"keystone_enable_member\": true}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_horizon\": {\"yaql\": {\"expression\": \"$.data.sources.flatten()\", \"data\": {\"sources\": [{\"get_param\": \"HorizonLoggingSource\"}]}}}}, \"haproxy\": {\"if\": [\"horizon_hsts_header_value_set\", {\"tripleo::profile::base::horizon::hsts_header_value\": {\"get_param\": \"HorizonHstsHeaderValue\"}}]}}, \"puppet_config\": {\"config_volume\": \"horizon\", \"puppet_tags\": \"horizon_config\", \"step_config\": \"include tripleo::profile::base::horizon\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHorizonConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/horizon.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/horizon/\", \"owner\": \"apache:apache\", \"recurse\": true}, {\"path\": \"/etc/openstack-dashboard/\", \"owner\": \"apache:apache\", \"recurse\": true}, {\"path\": \"/usr/share/openstack-dashboard/openstack_dashboard/local/\", \"owner\": \"apache:apache\", \"recurse\": false}, {\"path\": \"/usr/share/openstack-dashboard/openstack_dashboard/local/local_settings.d/\", \"owner\": \"apache:apache\", \"recurse\": false}]}}, \"docker_config\": {\"step_2\": {\"horizon_fix_perms\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHorizonImage\"]}, \"net\": \"none\", \"user\": \"root\", \"command\": [\"/bin/bash\", \"-c\", \"touch /var/log/horizon/horizon.log ; chown -R apache:apache /var/log/horizon && chmod -R a+rx /etc/openstack-dashboard\"], \"volumes\": [\"/var/log/containers/horizon:/var/log/horizon:z\", \"/var/log/containers/httpd/horizon:/var/log/httpd:z\", \"/var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard:/etc/openstack-dashboard\"]}}, \"step_3\": {\"horizon\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHorizonImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/horizon.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/horizon:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/horizon:/var/log/horizon:z\", \"/var/log/containers/httpd/horizon:/var/log/httpd:z\", \"/var/tmp/horizon:/var/tmp:z\", \"/var/www:/var/www:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"ENABLE_DESIGNATE\": \"yes\", \"ENABLE_HEAT\": \"yes\", \"ENABLE_IRONIC\": \"yes\", \"ENABLE_MANILA\": \"yes\", \"ENABLE_OCTAVIA\": \"yes\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/horizon\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/horizon\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/www\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/tmp/horizon\", \"setype\": \"container_file_t\", \"mode\": \"01777\"}]}, {\"name\": \"ensure /var/tmp/horizon exists on boot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/var-tmp-horizon.conf\", \"content\": \"d /var/tmp/horizon 01777 root root - -\\n\"}}], \"upgrade_tasks\": [{\"name\": \"Anchor for upgrade and update tasks\", \"when\": \"step|int == 0\", \"block\": [{\"name\": \"Reset selinux label on /var/tmp\", \"file\": {\"path\": \"/var/tmp\", \"state\": \"directory\", \"setype\": \"tmp_t\", \"mode\": 1023}}]}], \"update_tasks\": [{\"name\": \"Anchor for upgrade and update tasks\", \"when\": \"step|int == 0\", \"block\": [{\"name\": \"Reset selinux label on /var/tmp\", \"file\": {\"path\": \"/var/tmp\", \"state\": \"directory\", \"setype\": \"tmp_t\", \"mode\": 1023}}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop horizon container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"horizon\"], \"tripleo_delegate_to\": \"{{ groups['horizon'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/timesync/chrony-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Chrony time service deployment using ansible, this YAML file creates the interface between the HOT template and the ansible role that actually installs and configure chronyd.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NtpServer\": {\"default\": [\"0.pool.ntp.org\", \"1.pool.ntp.org\", \"2.pool.ntp.org\", \"3.pool.ntp.org\"], \"description\": \"NTP servers list. Defaulted to a set of pool.ntp.org servers in order to have a sane default for Pacemaker deployments when not configuring this parameter by default.\", \"type\": \"comma_delimited_list\"}, \"NtpPool\": {\"default\": [], \"description\": \"NTP pool list.  Defaults to [], so only NtpServer is used by default.\", \"type\": \"comma_delimited_list\"}, \"ChronyGlobalServerOptions\": {\"default\": \"\", \"description\": \"Default server options for the configured NTP servers in chrony.conf. If this is specified, NtpIburstEnable, MaxPoll, and MinPoll are ignored.\", \"type\": \"string\"}, \"ChronyGlobalPoolOptions\": {\"default\": \"\", \"description\": \"Default pool options for the configured NTP pools in chrony.conf. If this is specified, NtpIburstEnable, MaxPoll, and MinPoll are ignored.\", \"type\": \"string\"}, \"NtpIburstEnable\": {\"default\": true, \"description\": \"Specifies whether to enable the iburst option for every NTP peer. If iburst is enabled, when the ntp server is unreachable ntp will send a burst of eight packages instead of one. This is designed to speed up the initial syncrhonization.\", \"type\": \"boolean\"}, \"MaxPoll\": {\"description\": \"Specify maximum poll interval of upstream servers for NTP messages, in seconds to the power of two. The maximum poll interval defaults to 10 (1,024 s). Allowed values are 4 to 17.\", \"type\": \"number\", \"default\": 10, \"constraints\": [{\"range\": {\"min\": 4, \"max\": 17}}]}, \"MinPoll\": {\"description\": \"Specify minimum poll interval of upstream servers for NTP messages, in seconds to the power of two. The minimum poll interval defaults to 6 (64 s). Allowed values are 4 to 17.\", \"type\": \"number\", \"default\": 6, \"constraints\": [{\"range\": {\"min\": 4, \"max\": 17}}]}, \"EnablePackageInstall\": {\"default\": \"false\", \"description\": \"Set to true to enable package installation at deploy time\", \"type\": \"boolean\"}, \"ChronyAclRules\": {\"default\": [\"deny all\"], \"description\": \"Access Control List of NTP clients.  By default no clients are permitted.\", \"type\": \"comma_delimited_list\"}}, \"conditions\": {\"chrony_global_server_settings_is_empty\": {\"equals\": [{\"get_param\": \"ChronyGlobalServerOptions\"}, \"\"]}, \"chrony_global_pool_settings_is_empty\": {\"equals\": [{\"get_param\": \"ChronyGlobalPoolOptions\"}, \"\"]}, \"ntp_iburst\": {\"equals\": [{\"get_param\": \"NtpIburstEnable\"}, true]}}, \"outputs\": {\"role_data\": {\"description\": \"Role chrony using composable timesync services.\", \"value\": {\"service_name\": \"chrony\", \"firewall_rules\": {\"105 ntp\": {\"dport\": 123, \"proto\": \"udp\"}}, \"host_prep_tasks\": [{\"name\": \"Check for NTP service\", \"shell\": \"systemctl is-active ntpd.service || systemctl is-enabled ntpd.service\", \"failed_when\": false, \"become\": true, \"register\": \"ntp_service_check\"}, {\"name\": \"Disable NTP before configuring Chrony\", \"service\": {\"name\": \"ntpd\", \"state\": \"stopped\", \"enabled\": false}, \"when\": [\"ntp_service_check.rc is defined\", \"ntp_service_check.rc == 0\"]}, {\"name\": \"Install, Configure and Run Chrony\", \"include_role\": {\"name\": \"chrony\"}}, {\"name\": \"Force NTP sync\", \"command\": \"chronyc makestep\"}, {\"name\": \"Ensure system is NTP time synced\", \"command\": \"chronyc waitsync 30\"}], \"ansible_group_vars\": {\"chrony_role_action\": \"all\", \"chrony_ntp_servers\": {\"get_param\": \"NtpServer\"}, \"chrony_ntp_pools\": {\"get_param\": \"NtpPool\"}, \"chrony_global_server_settings\": {\"if\": [\"chrony_global_server_settings_is_empty\", {\"str_replace\": {\"template\": \"IBURST minpoll MINPOLL maxpoll MAXPOLL\", \"params\": {\"IBURST\": {\"if\": [\"ntp_iburst\", \"iburst\", \"\"]}, \"MINPOLL\": {\"get_param\": \"MinPoll\"}, \"MAXPOLL\": {\"get_param\": \"MaxPoll\"}}}}, {\"get_param\": \"ChronyGlobalServerOptions\"}]}, \"chrony_global_pool_settings\": {\"if\": [\"chrony_global_pool_settings_is_empty\", {\"str_replace\": {\"template\": \"IBURST minpoll MINPOLL maxpoll MAXPOLL\", \"params\": {\"IBURST\": {\"if\": [\"ntp_iburst\", \"iburst\", \"\"]}, \"MINPOLL\": {\"get_param\": \"MinPoll\"}, \"MAXPOLL\": {\"get_param\": \"MaxPoll\"}}}}, {\"get_param\": \"ChronyGlobalPoolOptions\"}]}, \"chrony_manage_package\": {\"get_param\": \"EnablePackageInstall\"}, \"chrony_acl_rules\": {\"get_param\": \"ChronyAclRules\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/timemaster/timemaster-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Time services such as timemaster with deployment using ansible, this YAML file creates the interface between the HOT template and the ansible roles that actually installs and configure chronyd and timemaster.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NtpServer\": {\"default\": [\"0.pool.ntp.org\", \"1.pool.ntp.org\", \"2.pool.ntp.org\", \"3.pool.ntp.org\"], \"description\": \"NTP servers list. Defaulted to a set of pool.ntp.org servers in order to have a sane default for Pacemaker deployments when not configuring this parameter by default.\", \"type\": \"comma_delimited_list\"}, \"NtpPool\": {\"default\": [], \"description\": \"NTP pool list.  Defaults to [], so only NtpServer is used by default.\", \"type\": \"comma_delimited_list\"}, \"ChronyGlobalServerOptions\": {\"default\": \"\", \"description\": \"Default server options for the configured NTP servers in chrony.conf. If this is specified, NtpIburstEnable, MaxPoll, and MinPoll are ignored.\", \"type\": \"string\"}, \"ChronyGlobalPoolOptions\": {\"default\": \"\", \"description\": \"Default pool options for the configured NTP pools in chrony.conf. If this is specified, NtpIburstEnable, MaxPoll, and MinPoll are ignored.\", \"type\": \"string\"}, \"NtpIburstEnable\": {\"default\": true, \"description\": \"Specifies whether to enable the iburst option for every NTP peer. If iburst is enabled, when the ntp server is unreachable ntp will send a burst of eight packages instead of one. This is designed to speed up the initial syncrhonization.\", \"type\": \"boolean\"}, \"MaxPoll\": {\"description\": \"Specify maximum poll interval of upstream servers for NTP messages, in seconds to the power of two. The maximum poll interval defaults to 10 (1,024 s). Allowed values are 4 to 17.\", \"type\": \"number\", \"default\": 10, \"constraints\": [{\"range\": {\"min\": 4, \"max\": 17}}]}, \"MinPoll\": {\"description\": \"Specify minimum poll interval of upstream servers for NTP messages, in seconds to the power of two. The minimum poll interval defaults to 6 (64 s). Allowed values are 4 to 17.\", \"type\": \"number\", \"default\": 6, \"constraints\": [{\"range\": {\"min\": 4, \"max\": 17}}]}, \"EnablePackageInstall\": {\"default\": \"false\", \"description\": \"Set to true to enable package installation at deploy time\", \"type\": \"boolean\"}, \"ChronyAclRules\": {\"default\": [\"deny all\"], \"description\": \"Access Control List of NTP clients.  By default no clients are permitted.\", \"type\": \"comma_delimited_list\"}, \"PTPInterfaces\": {\"default\": \"\", \"description\": \"Interfaces to be added to PTP domain\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"PTPMessageTransport\": {\"default\": \"\", \"description\": \"PTP transport mechanism, possible values UDPv4,L2\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"tripleo_ptp_interfaces\": \"PTPInterfaces\", \"tripleo_ptp_transport\": \"PTPMessageTransport\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"PTPInterfaces\": {\"get_param\": \"PTPInterfaces\"}, \"PTPMessageTransport\": {\"get_param\": \"PTPMessageTransport\"}}}]}}}}, \"conditions\": {\"chrony_global_server_settings_is_empty\": {\"equals\": [{\"get_param\": \"ChronyGlobalServerOptions\"}, \"\"]}, \"chrony_global_pool_settings_is_empty\": {\"equals\": [{\"get_param\": \"ChronyGlobalPoolOptions\"}, \"\"]}, \"ntp_iburst\": {\"equals\": [{\"get_param\": \"NtpIburstEnable\"}, true]}}, \"outputs\": {\"role_data\": {\"description\": \"Configure and starts timemaster service.\", \"value\": {\"host_prep_tasks\": [{\"name\": \"Configure and Run Timemaster\", \"include_role\": {\"name\": \"tripleo_timemaster\"}}], \"ansible_group_vars\": {\"chrony_role_action\": \"all\", \"chrony_ntp_servers\": {\"get_param\": \"NtpServer\"}, \"chrony_ntp_pools\": {\"get_param\": \"NtpPool\"}, \"tripleo_timemaster_role_action\": \"all\", \"chrony_global_server_settings\": {\"if\": [\"chrony_global_server_settings_is_empty\", {\"str_replace\": {\"template\": \"IBURST minpoll MINPOLL maxpoll MAXPOLL\", \"params\": {\"IBURST\": {\"if\": [\"ntp_iburst\", \"iburst\", \"\"]}, \"MINPOLL\": {\"get_param\": \"MinPoll\"}, \"MAXPOLL\": {\"get_param\": \"MaxPoll\"}}}}, {\"get_param\": \"ChronyGlobalServerOptions\"}]}, \"chrony_global_pool_settings\": {\"if\": [\"chrony_global_pool_settings_is_empty\", {\"str_replace\": {\"template\": \"IBURST minpoll MINPOLL maxpoll MAXPOLL\", \"params\": {\"IBURST\": {\"if\": [\"ntp_iburst\", \"iburst\", \"\"]}, \"MINPOLL\": {\"get_param\": \"MinPoll\"}, \"MAXPOLL\": {\"get_param\": \"MaxPoll\"}}}}, {\"get_param\": \"ChronyGlobalPoolOptions\"}]}, \"chrony_manage_package\": {\"get_param\": \"EnablePackageInstall\"}, \"chrony_acl_rules\": {\"get_param\": \"ChronyAclRules\"}, \"ptp_interfaces\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"tripleo_ptp_interfaces\"]}, \"ptp_transport\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"tripleo_ptp_transport\"]}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/tripleo-firewall/tripleo-firewall-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"TripleO Firewall settings\\n\", \"parameters\": {\"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ExtraFirewallRules\": {\"default\": {}, \"description\": \"Mapping of firewall rules.\", \"type\": \"json\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"extra_firewall_rules\": \"ExtraFirewallRules\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ExtraFirewallRules\": {\"get_param\": \"ExtraFirewallRules\"}}}]}}}}, \"conditions\": {\"no_ctlplane\": {\"equals\": [{\"get_params\": [\"ServiceData\", \"net_cidr_map\", \"ctlplane\"]}, null]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the TripleO firewall settings\", \"value\": {\"service_name\": \"tripleo_firewall\", \"config_settings\": {\"tripleo::firewall::manage_firewall\": false, \"tripleo::firewall::purge_firewall_rules\": false}, \"ansible_group_vars\": {\"tripleo_nftables_debug\": {\"get_param\": \"Debug\"}}, \"firewall_rules\": {\"map_merge\": [{\"map_merge\": {\"repeat\": {\"for_each\": {\"<%net_cidr%>\": {\"get_param\": [\"ServiceData\", \"net_cidr_map\", \"ctlplane\"]}}, \"template\": {\"003 accept ssh from ctlplane subnet <%net_cidr%>\": {\"source\": \"<%net_cidr%>\", \"proto\": \"tcp\", \"dport\": 22}}}}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"extra_firewall_rules\"]}]}, \"host_prep_tasks\": [{\"if\": [\"no_ctlplane\", {\"name\": \"Failure - ctlplane subnet is unset\", \"fail\": {\"msg\": \"No CIDRs found in the ctlplane network tags.\\nPlease refer to the documentation in order to\\nset the correct network tags in DeployedServerPortMap.\\n\"}}, {\"name\": \"Notice - ctlplane subnet is set\", \"debug\": {\"msg\": \"CIDRs found in the ctlplane network tags.\\n\"}}]}], \"host_firewall_tasks\": [{\"name\": \"Run firewall role\", \"include_role\": {\"name\": \"tripleo_firewall\"}}], \"update_tasks\": [{\"name\": \"Cleanup tripleo-iptables services\", \"when\": [\"(step | int) == 1\"], \"block\": [{\"name\": \"Disable tripleo-iptables.service\", \"systemd\": {\"name\": \"tripleo-iptables.service\", \"state\": \"stopped\", \"enabled\": false}, \"register\": \"systemd_tripleo_iptables\", \"failed_when\": false}, {\"name\": \"Cleanup tripleo-iptables.services\", \"file\": {\"path\": \"/etc/systemd/system/tripleo-iptables.service\", \"state\": \"absent\"}}, {\"name\": \"Disable tripleo-ip6tables.service\", \"systemd\": {\"name\": \"tripleo-ip6tables.service\", \"state\": \"stopped\", \"enabled\": false}, \"register\": \"systemd_tripleo_ip6tables\", \"failed_when\": false}, {\"name\": \"Cleanup tripleo-ip6tables.services\", \"file\": {\"path\": \"/etc/systemd/system/tripleo-ip6tables.service\", \"state\": \"absent\"}}, {\"name\": \"Reload systemd\", \"systemd\": {\"daemon_reload\": true}, \"when\": [\"(systemd_tripleo_iptables is changed or systemd_tripleo_ip6tables is changed)\"]}]}], \"upgrade_tasks\": [{\"name\": \"Cleanup tripleo-iptables services\", \"when\": [\"(step | int) == 1\"], \"block\": [{\"name\": \"Disable tripleo-iptables.service\", \"systemd\": {\"name\": \"tripleo-iptables.service\", \"state\": \"stopped\", \"enabled\": false}, \"register\": \"systemd_tripleo_iptables\", \"failed_when\": false}, {\"name\": \"Cleanup tripleo-iptables.services\", \"file\": {\"path\": \"/etc/systemd/system/tripleo-iptables.service\", \"state\": \"absent\"}}, {\"name\": \"Disable tripleo-ip6tables.service\", \"systemd\": {\"name\": \"tripleo-ip6tables.service\", \"state\": \"stopped\", \"enabled\": false}, \"register\": \"systemd_tripleo_ip6tables\", \"failed_when\": false}, {\"name\": \"Cleanup tripleo-ip6tables.services\", \"file\": {\"path\": \"/etc/systemd/system/tripleo-ip6tables.service\", \"state\": \"absent\"}}, {\"name\": \"Reload systemd\", \"systemd\": {\"daemon_reload\": true}, \"when\": [\"(systemd_tripleo_iptables is changed or systemd_tripleo_ip6tables is changed)\"]}]}, {\"when\": [\"(step | int) == 3\"], \"block\": [{\"name\": \"blank ipv6 rule before activating ipv6 firewall.\", \"shell\": \"cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables\", \"args\": {\"creates\": \"/etc/sysconfig/ip6tables.n-o-upgrade\"}}, {\"name\": \"cleanup unmanaged rules pushed by iptables-services\", \"shell\": \"iptables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \\\\\\n  iptables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\\niptables -C INPUT -p icmp -j ACCEPT &>/dev/null && \\\\\\n  iptables -D INPUT -p icmp -j ACCEPT\\niptables -C INPUT -i lo -j ACCEPT &>/dev/null && \\\\\\n  iptables -D INPUT -i lo -j ACCEPT\\niptables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \\\\\\n  iptables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\\niptables -C INPUT -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \\\\\\n  iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited\\niptables -C FORWARD -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \\\\\\n  iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited\\n\\nsed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/iptables\\nsed -i '/^-A INPUT -p icmp -j ACCEPT$/d' /etc/sysconfig/iptables\\nsed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/iptables\\nsed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/iptables\\nsed -i '/^-A INPUT -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables\\nsed -i '/^-A FORWARD -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables\\n\\nip6tables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \\\\\\n  ip6tables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\\nip6tables -C INPUT -p ipv6-icmp -j ACCEPT &>/dev/null && \\\\\\n  ip6tables -D INPUT -p ipv6-icmp -j ACCEPT\\nip6tables -C INPUT -i lo -j ACCEPT &>/dev/null && \\\\\\n  ip6tables -D INPUT -i lo -j ACCEPT\\nip6tables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \\\\\\n  ip6tables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\\nip6tables -C INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT &>/dev/null && \\\\\\n  ip6tables -D INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT\\nip6tables -C INPUT -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \\\\\\n  ip6tables -D INPUT -j REJECT --reject-with icmp6-adm-prohibited\\nip6tables -C FORWARD -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \\\\\\n  ip6tables -D FORWARD -j REJECT --reject-with icmp6-adm-prohibited\\n\\nsed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/ip6tables\\nsed -i '/^-A INPUT -p ipv6-icmp -j ACCEPT$/d' /etc/sysconfig/ip6tables\\nsed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/ip6tables\\nsed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/ip6tables\\nsed -i '/^-A INPUT -d fe80::\\\\/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT$/d' /etc/sysconfig/ip6tables\\nsed -i '/^-A INPUT -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables\\nsed -i '/^-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables\"}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/podman/podman-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configures podman on the host\\n\", \"parameters\": {\"DockerInsecureRegistryAddress\": {\"description\": \"Optional. The IP Address and Port of an insecure docker namespace that will be configured in /etc/sysconfig/docker. The value can be multiple addresses separated by commas.\", \"type\": \"comma_delimited_list\", \"default\": []}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerImageRegistryLogin\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Flag to enable container registry login actions during the deployment. Setting this to true will cause login calls to be performed during the deployment.\"}, \"ContainerImageRegistryCredentials\": {\"type\": \"json\", \"hidden\": true, \"default\": {}, \"description\": \"Mapping of image registry hosts to login credentials. Must be in the following example format\\n\\n  docker.io:\\n    username: pa55word\\n  '192.0.2.1:8787':\\n    registry_username: password\\n\"}, \"ContainerDefaultPidsLimit\": {\"type\": \"number\", \"default\": 4096, \"description\": \"Setting to configure the default pids_limit in /etc/container/container.conf. This is supported starting with podman 2.0.x\"}, \"ContainerDefaultEventsLogger\": {\"type\": \"string\", \"default\": \"journald\", \"description\": \"Setting to configure where podman logs its events. Uses journald by default as that will rotate data stored in tmpfs.\", \"constraints\": [{\"allowed_values\": [\"journald\", \"file\", \"none\"]}]}, \"SystemdDropInDependencies\": {\"default\": true, \"description\": \"tell the tripleo_container_manage to inject additional ordering dependencies for the systemd scopes associated to podman containers.\", \"type\": \"boolean\"}, \"deployment_source_hosts\": {\"default\": \"Undercloud\", \"type\": \"string\", \"description\": \"Host or hostgroup that runs the deployment\"}}, \"conditions\": {\"insecure_registry_is_empty\": {\"equals\": [{\"get_param\": \"DockerInsecureRegistryAddress\"}, []]}, \"systemd_drop_in_dependencies_enabled\": {\"get_param\": \"SystemdDropInDependencies\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the podman service\", \"value\": {\"service_name\": \"podman\", \"config_settings\": {}, \"step_config\": \"\", \"host_prep_tasks\": [{\"name\": \"Install and configure Podman\", \"block\": [{\"name\": \"Set login facts\", \"no_log\": true, \"set_fact\": {\"container_registry_insecure_registries\": {\"if\": [\"insecure_registry_is_empty\", [], {\"get_param\": \"DockerInsecureRegistryAddress\"}]}, \"container_registry_login\": {\"get_param\": \"ContainerImageRegistryLogin\"}, \"container_registry_logins\": {}, \"container_registry_logins_json\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"container_default_pids_limit\": {\"get_param\": \"ContainerDefaultPidsLimit\"}, \"container_events_logger_mechanism\": {\"get_param\": \"ContainerDefaultEventsLogger\"}}}, {\"name\": \"Convert logins json to dict\", \"no_log\": true, \"set_fact\": {\"container_registry_logins\": \"{{ container_registry_logins_json | from_json }}\"}, \"when\": [\"container_registry_logins_json is string\", \"container_registry_login | bool\", \"(container_registry_logins_json | length) > 0\"]}, {\"name\": \"Set registry logins\", \"no_log\": true, \"set_fact\": {\"container_registry_logins\": \"{{ container_registry_logins_json }}\"}, \"when\": [\"container_registry_logins_json is mapping\", \"container_registry_login | bool\", \"(container_registry_logins_json | length) > 0\"]}, {\"name\": \"Run podman install\", \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_install.yml\"}, \"vars\": {\"tripleo_container_registry_insecure_registries\": \"{{ container_registry_insecure_registries }}\", \"tripleo_container_default_pids_limit\": \"{{ container_default_pids_limit }}\", \"tripleo_container_events_logger_mechanism\": \"{{ container_events_logger_mechanism }}\"}}, {\"name\": \"Run podman login\", \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_login.yml\"}, \"vars\": {\"tripleo_container_registry_logins\": \"{{ container_registry_logins }}\", \"tripleo_container_registry_login\": \"{{ container_registry_login | bool }}\"}}]}, {\"if\": [\"systemd_drop_in_dependencies_enabled\", [{\"name\": \"Configure tripleo_container_manage to generate systemd drop-in dependencies\", \"copy\": {\"dest\": \"/etc/sysconfig/podman_drop_in\", \"content\": \"This file makes tripleo_container_manage generate additional systemd\\ndependencies for containers that have special\\nstart/stop ordering constraints. It ensures that\\nthose constraints are enforced on reboot/shutdown.\\n\"}}], [{\"name\": \"Configure tripleo_container_manage to not generate drop-in dependencies\", \"file\": {\"path\": \"/etc/sysconfig/podman_drop_in\", \"state\": \"absent\"}}]]}], \"deploy_steps_tasks\": [{\"when\": [\"(step|int) == 1\"], \"block\": [{\"name\": \"Pre-fetch all the containers\", \"become\": true, \"containers.podman.podman_image\": {\"name\": \"{{ prefetch_image }}\", \"validate_certs\": false, \"force\": true}, \"register\": \"result\", \"until\": \"result is succeeded\", \"retries\": 5, \"delay\": 5, \"loop_control\": {\"loop_var\": \"prefetch_image\"}, \"loop\": \"{{ lookup('template', tripleo_role_name + '/docker_config.yaml', errors='ignore') | default('{}', True) | from_yaml | recursive_get_key_from_dict(key='image') | unique }}\"}]}], \"service_config_settings\": {}, \"workaround_upgrade_tasks\": [{\"name\": \"Configure Podman registry\", \"when\": [\"step|int == 0\"], \"tags\": [\"setup_packages\"], \"block\": [{\"name\": \"Make sure the Undercloud hostname is included in /etc/hosts\", \"when\": [\"undercloud_hosts_entries is defined\"], \"lineinfile\": {\"dest\": \"/etc/hosts\", \"line\": \"{{ undercloud_hosts_entries | join('') }}\", \"state\": \"present\"}}]}, {\"name\": \"Run podman install\", \"tags\": [\"system_upgrade\", \"system_upgrade_run\", \"setup_packages\"], \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Set login facts\", \"no_log\": true, \"set_fact\": {\"container_registry_insecure_registries\": {\"if\": [\"insecure_registry_is_empty\", [], {\"get_param\": \"DockerInsecureRegistryAddress\"}]}, \"container_registry_login\": {\"get_param\": \"ContainerImageRegistryLogin\"}, \"container_registry_logins\": {}, \"container_registry_logins_json\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"container_default_pids_limit\": {\"get_param\": \"ContainerDefaultPidsLimit\"}, \"container_events_logger_mechanism\": {\"get_param\": \"ContainerDefaultEventsLogger\"}}}, {\"name\": \"Convert logins json to dict\", \"no_log\": true, \"set_fact\": {\"container_registry_logins\": \"{{ container_registry_logins_json | from_json }}\"}, \"when\": [\"container_registry_logins_json is string\", \"container_registry_login | bool\", \"(container_registry_logins_json | length) > 0\"]}, {\"name\": \"Set registry logins\", \"no_log\": true, \"set_fact\": {\"container_registry_logins\": \"{{ container_registry_logins_json }}\"}, \"when\": [\"container_registry_logins_json is mapping\", \"container_registry_login | bool\", \"(container_registry_logins_json | length) > 0\"]}, {\"name\": \"Run podman install\", \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_install.yml\"}, \"vars\": {\"tripleo_container_registry_insecure_registries\": \"{{ container_registry_insecure_registries }}\", \"tripleo_container_default_pids_limit\": \"{{ container_default_pids_limit }}\", \"tripleo_container_events_logger_mechanism\": \"{{ container_events_logger_mechanism }}\"}}, {\"name\": \"Run podman login\", \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_login.yml\"}, \"vars\": {\"tripleo_container_registry_logins\": \"{{ container_registry_logins }}\", \"tripleo_container_registry_login\": \"{{ container_registry_login | bool }}\"}}]}, {\"name\": \"Comment infra_image in container.conf\", \"lineinfile\": {\"dest\": \"/usr/share/containers/containers.conf\", \"regexp\": \"(?i)^(infra_image.*)\", \"line\": \"#\\\\1\", \"backrefs\": true, \"state\": \"present\"}, \"tags\": [\"setup_packages\"], \"when\": [\"step|int == 0\"]}], \"upgrade_tasks\": [{\"name\": \"Configure Podman registry\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Make sure the Undercloud hostname is included in /etc/hosts\", \"when\": [\"undercloud_hosts_entries is defined\"], \"lineinfile\": {\"dest\": \"/etc/hosts\", \"line\": \"{{ undercloud_hosts_entries | join('') }}\", \"state\": \"present\"}}]}, {\"name\": \"Run podman install\", \"tags\": [\"system_upgrade\", \"system_upgrade_run\"], \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Set login facts\", \"no_log\": true, \"set_fact\": {\"container_registry_insecure_registries\": {\"if\": [\"insecure_registry_is_empty\", [], {\"get_param\": \"DockerInsecureRegistryAddress\"}]}, \"container_registry_login\": {\"get_param\": \"ContainerImageRegistryLogin\"}, \"container_registry_logins\": {}, \"container_registry_logins_json\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"container_default_pids_limit\": {\"get_param\": \"ContainerDefaultPidsLimit\"}, \"container_events_logger_mechanism\": {\"get_param\": \"ContainerDefaultEventsLogger\"}}}, {\"name\": \"Convert logins json to dict\", \"no_log\": true, \"set_fact\": {\"container_registry_logins\": \"{{ container_registry_logins_json | from_json }}\"}, \"when\": [\"container_registry_logins_json is string\", \"container_registry_login | bool\", \"(container_registry_logins_json | length) > 0\"]}, {\"name\": \"Set registry logins\", \"no_log\": true, \"set_fact\": {\"container_registry_logins\": \"{{ container_registry_logins_json }}\"}, \"when\": [\"container_registry_logins_json is mapping\", \"container_registry_login | bool\", \"(container_registry_logins_json | length) > 0\"]}, {\"name\": \"Run podman install\", \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_install.yml\"}, \"vars\": {\"tripleo_container_registry_insecure_registries\": \"{{ container_registry_insecure_registries }}\", \"tripleo_container_default_pids_limit\": \"{{ container_default_pids_limit }}\", \"tripleo_container_events_logger_mechanism\": \"{{ container_events_logger_mechanism }}\"}}, {\"name\": \"Run podman login\", \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_login.yml\"}, \"vars\": {\"tripleo_container_registry_logins\": \"{{ container_registry_logins }}\", \"tripleo_container_registry_login\": \"{{ container_registry_login | bool }}\"}}]}], \"update_tasks\": [{\"name\": \"Force pre-fetch of container images\", \"when\": [\"(step|int) == 5\"], \"block\": [{\"name\": \"Pre-fetch all the containers\", \"become\": true, \"containers.podman.podman_image\": {\"name\": \"{{ prefetch_image }}\", \"validate_certs\": false, \"force\": true}, \"register\": \"result\", \"until\": \"result is succeeded\", \"retries\": 5, \"delay\": 5, \"loop_control\": {\"loop_var\": \"prefetch_image\"}, \"loop\": \"{{ lookup('template', tripleo_role_name + '/docker_config.yaml', errors='ignore') | default('{}', True) | from_yaml | recursive_get_key_from_dict(key='image') | unique }}\"}]}], \"post_upgrade_tasks\": [{\"name\": \"Purge Podman\", \"when\": [\"(step | int) == 3\", \"container_cli == 'podman'\", \"deployment_source_hosts not in group_names\"], \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_purge.yml\"}, \"vars\": {\"deployment_source_hosts\": {\"get_param\": \"deployment_source_hosts\"}}}], \"post_update_tasks\": [{\"name\": \"Purge Podman\", \"when\": [\"(step | int) == 3\", \"container_cli == 'podman'\", \"deployment_source_hosts not in group_names\"], \"include_role\": {\"name\": \"tripleo_podman\", \"tasks_from\": \"tripleo_podman_purge.yml\"}, \"vars\": {\"deployment_source_hosts\": {\"get_param\": \"deployment_source_hosts\"}}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/tripleo-packages/tripleo-packages-baremetal-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"TripleO Package installation settings\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnablePackageInstall\": {\"default\": \"false\", \"description\": \"Set to true to enable package installation at deploy time\", \"type\": \"boolean\"}, \"UpgradeLeappEnabled\": {\"description\": \"Use Leapp for operating system upgrade\", \"type\": \"boolean\", \"default\": false}, \"UpgradeLeappDebug\": {\"description\": \"Print debugging output when running Leapp\", \"type\": \"boolean\", \"default\": false}, \"UpgradeLeappDevelSkip\": {\"description\": \"Skip Leapp checks by setting env variables when running Leapp in\\ndevelopment/testing. For example, LEAPP_DEVEL_SKIP_RHSM=1.\\n\", \"type\": \"string\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"UpgradeLeappCommandOptions\": {\"description\": \"In case or using UpgradeLeappDevelSkip with LEAPP_NO_RHSM=1 user\\ncan specify --enablerepo <repo1> --enablerepo <repo2> options for\\nleapp to use these repositories for the upgrade process.\\n\", \"type\": \"string\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"UpgradeLeappRebootTimeout\": {\"description\": \"Timeout (seconds) for the OS upgrade phase via Leapp\", \"type\": \"number\", \"default\": 3600}, \"UpgradeLeappPostRebootDelay\": {\"description\": \"Maximum (seconds) to wait for machine to reboot and respond to a test\\ncommand.\\n\", \"type\": \"number\", \"default\": 120}, \"UpgradeLeappToRemove\": {\"default\": [], \"description\": \"List of packages to remove during Leapp upgrade.\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"UpgradeLeappToInstall\": {\"default\": [], \"description\": \"List of packages to install after Leapp upgrade.\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"LeappUnloadKernelDrivers\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"List of modules to unload from the system due to being incompatible\\nwith the next RHEL version. If not being unloaded Leapp will\\ninhibit the upgrade.\\n\"}, \"LeappActorsToRemove\": {\"type\": \"comma_delimited_list\", \"default\": [], \"description\": \"List of actors to remove from the leapp process to prevent them\\nfrom inhibiting the upgrade.\\n\"}, \"LeappRepoInitCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\ninitialize the Leapp process. E.g. a repository switch.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"LeappInitCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\napply any necessary workarounds to get Leapp working.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NICsPrefixesToUdev\": {\"default\": [], \"description\": \"List of NIC prefixes to hardcode into udev in order to prevent\\nrenaming.\\n\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"LeappPreRebootCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\napply any necessary workarounds before rebooting into Leapp.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"LeappPostRebootCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\napply any necessary workarounds after rebooting from Leapp.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"UpgradeInitCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\ninitialize the upgrade process. E.g. a repository switch.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"UpgradeInitCommonCommand\": {\"type\": \"string\", \"description\": \"Common commands required by the upgrades process. This should not\\nnormally be modified by the operator and is set and unset in the\\nmajor-upgrade-composable-steps.yaml and major-upgrade-converge.yaml\\nenvironment files.\\n\", \"default\": \"\"}, \"SkipPackageUpdate\": {\"default\": false, \"description\": \"Set to true to skip the update all packages\", \"type\": \"boolean\"}, \"SkipRhelEnforcement\": {\"default\": false, \"description\": \"Whether to avoid or not RHEL/OSP policies enforcement on Red Hat. Mainly for CI purpose.  It shouldn't matter on other distributions where it's disabled in the role. Set to true to skip the enforcement.\", \"type\": \"boolean\"}, \"DnfStreams\": {\"default\": [], \"description\": \"List of streams to be configured before updating packages. Each list element contains a dictionary with the following values defined module[mandatory], stream[mandatory], distribution_version[mandatory] and profile[optional]. If the profile is not specified 'common' will be used instead.\", \"type\": \"json\", \"tags\": [\"role_specific\"]}, \"BaseTripleoPackages\": {\"default\": [], \"description\": \"List of packages to install.\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"ContainerImageRegistryLogin\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Flag to enable container registry login actions during the deployment. Setting this to true will cause login calls to be performed during the deployment.\"}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"dnf_module_list\": \"DnfStreams\", \"upgrade_leapp_devel_skip\": \"UpgradeLeappDevelSkip\", \"upgrade_leapp_command_options\": \"UpgradeLeappCommandOptions\", \"upgrade_leapp_to_remove\": \"UpgradeLeappToRemove\", \"upgrade_leapp_to_install\": \"UpgradeLeappToInstall\", \"leapp_repo_init_command\": \"LeappRepoInitCommand\", \"leapp_init_command\": \"LeappInitCommand\", \"nics_prefixes_to_keep\": \"NICsPrefixesToUdev\", \"upgrade_leapp_modules_to_unload\": \"LeappUnloadKernelDrivers\", \"upgrade_leapp_actors_to_remove\": \"LeappActorsToRemove\", \"upgrade_init_command\": \"UpgradeInitCommand\", \"base_tripleo_packages\": \"BaseTripleoPackages\", \"leapp_pre_reboot_command\": \"LeappPreRebootCommand\", \"leapp_post_reboot_command\": \"LeappPostRebootCommand\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"DnfStreams\": {\"get_param\": \"DnfStreams\"}, \"UpgradeLeappDevelSkip\": {\"get_param\": \"UpgradeLeappDevelSkip\"}, \"UpgradeLeappCommandOptions\": {\"get_param\": \"UpgradeLeappCommandOptions\"}, \"UpgradeLeappToRemove\": {\"get_param\": \"UpgradeLeappToRemove\"}, \"UpgradeLeappToInstall\": {\"get_param\": \"UpgradeLeappToInstall\"}, \"LeappUnloadKernelDrivers\": {\"get_param\": \"LeappUnloadKernelDrivers\"}, \"LeappPreRebootCommand\": {\"get_param\": \"LeappPreRebootCommand\"}, \"LeappPostRebootCommand\": {\"get_param\": \"LeappPostRebootCommand\"}, \"LeappActorsToRemove\": {\"get_param\": \"LeappActorsToRemove\"}, \"UpgradeInitCommand\": {\"get_param\": \"UpgradeInitCommand\"}, \"LeappRepoInitCommand\": {\"get_param\": \"LeappRepoInitCommand\"}, \"LeappInitCommand\": {\"get_param\": \"LeappInitCommand\"}, \"NICsPrefixesToUdev\": {\"get_param\": \"NICsPrefixesToUdev\"}, \"BaseTripleoPackages\": {\"get_param\": \"BaseTripleoPackages\"}}}]}}}, \"Podman\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/podman/podman-baremetal-ansible.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"conditions\": {\"podman_requires_login\": {\"equals\": [{\"get_param\": \"ContainerImageRegistryLogin\"}, true]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the TripleO package settings\", \"value\": {\"service_name\": \"tripleo_packages\", \"config_settings\": {\"tripleo::packages::enable_install\": {\"get_param\": \"EnablePackageInstall\"}}, \"step_config\": \"include ::tripleo::packages\\n\", \"upgrade_tasks\": {\"list_concat\": [[{\"name\": \"Gather missing facts\", \"setup\": {\"gather_subset\": [\"!all\", \"!min\", \"distribution\"]}, \"tags\": [\"always\"]}, {\"name\": \"Set leapp facts\", \"set_fact\": {\"upgrade_leapp_enabled\": \"{{ _upgradeLeappEnabled | bool and\\n   ansible_facts['distribution'] == 'RedHat' and\\n   ansible_facts['distribution_major_version'] is version('8', '==') }}\", \"upgrade_leapp_debug\": {\"get_param\": \"UpgradeLeappDebug\"}, \"upgrade_leapp_devel_skip\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_leapp_devel_skip\"]}, \"upgrade_leapp_command_options\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_leapp_command_options\"]}, \"upgrade_leapp_reboot_timeout\": {\"get_param\": \"UpgradeLeappRebootTimeout\"}, \"upgrade_leapp_post_reboot_delay\": {\"get_param\": \"UpgradeLeappPostRebootDelay\"}}, \"vars\": {\"_upgradeLeappEnabled\": {\"get_param\": \"UpgradeLeappEnabled\"}}, \"tags\": [\"always\"]}, {\"name\": \"system_upgrade_prepare step 3\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_prepare\"], \"when\": [\"step|int == 3\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Run LeappRepoInitCommand\", \"shell\": {\"list_join\": [\"\", [\"#!/bin/bash\\n\\n\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"leapp_repo_init_command\"]}]]}}, {\"name\": \"Remove firewalld bindings\", \"package\": {\"name\": \"python3-firewall\", \"state\": \"absent\"}}, {\"name\": \"install leapp\", \"package\": {\"name\": \"leapp-repository-openstack\", \"state\": \"latest\"}}, {\"name\": \"Run LeappInitCommand\", \"shell\": {\"list_join\": [\"\", [\"#!/bin/bash\\n\\n\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"leapp_init_command\"]}]]}}, {\"name\": \"Remove vdo\", \"package\": {\"name\": \"vdo\", \"state\": \"absent\"}}, {\"name\": \"add packages into Leapp's to_remove file\", \"vars\": {\"pkg_to_remove\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_leapp_to_remove\"]}}, \"lineinfile\": {\"path\": \"/etc/leapp/transaction/to_remove\", \"line\": \"{{ item }}\"}, \"loop\": \"{{ pkg_to_remove }}\"}, {\"name\": \"add packages into Leapp's to_install file\", \"vars\": {\"pkg_to_install\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_leapp_to_install\"]}}, \"lineinfile\": {\"path\": \"/etc/leapp/transaction/to_install\", \"line\": \"{{ item }}\"}, \"loop\": \"{{ pkg_to_install }}\"}, {\"name\": \"check sshd_config file\", \"stat\": {\"path\": \"/etc/ssh/sshd_config\"}, \"register\": \"sshd_config_result\"}, {\"name\": \"add PermitRootLogin option for leapp\", \"lineinfile\": {\"path\": \"/etc/ssh/sshd_config\", \"regexp\": \"^(# *)?PermitRootLogin\", \"line\": \"PermitRootLogin without-password\"}}, {\"name\": \"Remove paunch-services\", \"package\": {\"name\": \"paunch-services\", \"state\": \"absent\"}}, {\"name\": \"tripleo_container_manage reconfiguration\", \"import_role\": {\"name\": \"tripleo_container_manage\", \"tasks_from\": \"shutdown.yml\"}}]}, {\"name\": \"system_upgrade_prepare step 4\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_prepare\"], \"when\": [\"step|int == 4\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Delete the kernel modules in Leapp database (device_driver_deprecation_data.json)\", \"vars\": {\"modules_to_unload\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_leapp_modules_to_unload\"]}}, \"shell\": \"set -o pipefail && jq '. | del(.data[] | select(.driver_name == \\\"{{ item }}\\\"))' /etc/leapp/files/device_driver_deprecation_data.json > /etc/leapp/files/device_driver_deprecation_data.json_modified && mv /etc/leapp/files/device_driver_deprecation_data.json_modified /etc/leapp/files/device_driver_deprecation_data.json\\n\", \"loop\": \"{{ modules_to_unload }}\"}, {\"name\": \"Remove leapp actors to prevent them inhibiting the upgrade\", \"vars\": {\"actors_to_remove\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_leapp_actors_to_remove\"]}}, \"command\": {\"cmd\": \"find /usr/share/leapp-repository/repositories/ -name {{ item }} -type d -print -exec rm -rf \\\"{}\\\" +\"}, \"loop\": \"{{ actors_to_remove }}\"}, {\"name\": \"set leapp required answers\", \"shell\": \"leapp answer --add --section check_vdo.confirm=True\\n\"}, {\"name\": \"Replace EFI grub.cfg with redirect to /boot/grub2/grub.cfg\", \"import_role\": {\"name\": \"tripleo_kernel\", \"tasks_from\": \"efigrub.yml\"}}, {\"name\": \"Keep nics with prefix in NICsPrefixesToUdev from renaming\", \"vars\": {\"nics_prefixes_to_keep\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"nics_prefixes_to_keep\"]}}, \"shell\": \"ip -j link show | \\\\ jq -r --arg prefix \\\"{{ item }}\\\" '.[] |\\n  select((.ifname | startswith($prefix)) and\\n  (.ifname | test(\\\"^.*v[0-9]*$\\\") | not) and\\n  (.ifname | test(\\\"^.*_[0-9]*$\\\") | not) and\\n  (.ifname | test(\\\"^.*\\\\\\\\..*$\\\") | not)) |\\n  if .permaddr? then .address=.permaddr else . end |\\n  \\\"SUBSYSTEM==\\\\\\\"net\\\\\\\",ACTION==\\\\\\\"add\\\\\\\",DRIVERS==\\\\\\\"?*\\\\\\\",\\\" + \\\"NAME=\\\\\\\"\\\" + .ifname +\\\"\\\\\\\" ,ATTR{address}==\\\\\\\"\\\" + .address + \\\"\\\\\\\"\\\"' >> /etc/udev/rules.d/70-rhosp-persistent-net.rules\\n\", \"loop\": \"{{ nics_prefixes_to_keep|list }}\"}, {\"name\": \"run leapp upgrade (download packages)\", \"shell\": \"{% if upgrade_leapp_devel_skip|default(false) %}{{ upgrade_leapp_devel_skip }}{% endif %} leapp upgrade {% if upgrade_leapp_debug|default(true) %}--debug{% endif %} {% if upgrade_leapp_command_options|default(false) %}{{ upgrade_leapp_command_options }}{% endif %}\\n\", \"when\": \"upgrade_leapp_enabled\"}]}, {\"name\": \"system_upgrade_run step 4\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_reboot\"], \"when\": [\"step|int == 4\", \"upgrade_leapp_enabled\", \"'Undercloud' not in group_names\"], \"block\": [{\"name\": \"Run LeappPreRebootCommand\", \"shell\": {\"list_join\": [\"\", [\"#!/bin/bash\\n\\n\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"leapp_pre_reboot_command\"]}]]}}, {\"name\": \"Check that nova_libvirt is running\", \"shell\": \"podman ps --filter name=^nova_virtlogd$ --format \\\"{% raw %}{{ .Image }}{% endraw %}\\\"\\n\", \"register\": \"is_virtlogd_image_running\"}, {\"name\": \"Remove systemd files to disable them\", \"file\": {\"path\": \"/etc/systemd/system/{{ item }}\", \"state\": \"absent\"}, \"with_items\": [\"tripleo_nova_libvirt.service\", \"tripleo_nova_virtlogd_wrapper.service\", \"tripleo_nova_libvirt.target\"], \"when\": \"is_virtlogd_image_running.stdout != ''\"}, {\"name\": \"reboot to perform the upgrade\", \"reboot\": {\"reboot_timeout\": \"{{upgrade_leapp_reboot_timeout}}\", \"test_command\": \"source /etc/os-release; [ \\\"${VERSION_ID%.*}\\\" -ge \\\"8\\\" ] && systemctl is-system-running | grep -qE \\\"running|degraded\\\" || exit 1\", \"post_reboot_delay\": \"{{ upgrade_leapp_post_reboot_delay }}\"}}, {\"name\": \"Set selinux back to enforcing after leapp reboot\", \"selinux\": {\"policy\": \"targeted\", \"state\": \"enforcing\"}}, {\"name\": \"Run LeappPostRebootCommand\", \"shell\": {\"list_join\": [\"\", [\"#!/bin/bash\\n\\n\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"leapp_post_reboot_command\"]}]]}}]}, {\"name\": \"Host packages setup step0\", \"tags\": \"setup_packages\", \"when\": \"step|int == 0\", \"block\": [{\"name\": \"Package and repo update tasks\", \"block\": [{\"name\": \"Run UpgradeInitCommand\", \"shell\": {\"list_join\": [\"\", [\"#!/bin/bash\\n\\n\", \"if [[ -f /etc/resolv.conf.save ]] ; then rm /etc/resolv.conf.save; fi\\n\\n\", {\"get_attr\": [\"RoleParametersValue\", \"value\", \"upgrade_init_command\"]}]]}}, {\"name\": \"Run UpgradeInitCommonCommand\", \"shell\": {\"list_join\": [\"\", [\"#!/bin/bash\\n\\n\", {\"get_param\": \"UpgradeInitCommonCommand\"}]]}}, {\"name\": \"Ensure DNF modules have the right stream\", \"vars\": {\"dnf_module_list\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"dnf_module_list\"]}}, \"dnf\": {\"name\": \"@{{ item.module }}:{{ item.stream }}/{{ item.profile|default('common') }}\", \"state\": \"present\"}, \"loop\": \"{{ dnf_module_list|list }}\", \"when\": [\"dnf_module_list|length > 0\", \"item.distribution_version is defined\", \"ansible_facts['distribution_major_version'] is version(item.distribution_version, '==')\"]}, {\"name\": \"Ensure TripleO prerequisite packages are installed\", \"package\": {\"name\": [\"jq\", \"lvm2\", \"openstack-selinux\", \"os-net-config\", \"puppet-tripleo\", \"python3-heat-agent*\", \"rsync\"], \"state\": \"present\"}, \"when\": \"ansible_facts['distribution_major_version'] is version('8', '==')\"}, {\"name\": \"Ensure TripleO prerequisite packages are installed and use role based heat variable to provide specific list of packages\", \"vars\": {\"base_tripleo_packages\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"base_tripleo_packages\"]}}, \"package\": {\"name\": \"{{ base_tripleo_packages }}\", \"state\": \"present\"}, \"when\": [\"ansible_facts['distribution_major_version'] is version('8', '==')\", \"base_tripleo_packages|length > 0\"]}, {\"name\": \"WA for 2240185 - If the image is schema 1 and lacks signatures than add empty signatures\", \"shell\": \"for manifest_file in `find /var/lib/containers/storage/overlay-images/ -name 'manifest'`\\ndo\\n    cat <<< $( jq  'if .schemaVersion == 1 then if has(\\\"signatures\\\") then . else .signatures=[] end else . end' $manifest_file ) > $manifest_file\\ndone\\n\", \"when\": \"ansible_facts['distribution_major_version'] is version('8', '==')\"}]}, {\"name\": \"check if libvirt is installed\", \"command\": \"/usr/bin/rpm -q libvirt-daemon\", \"failed_when\": false, \"register\": \"libvirt_installed\", \"check_mode\": false}, {\"name\": \"make sure libvirt services are disabled and masked\", \"service\": {\"name\": \"{{ item }}\", \"state\": \"stopped\", \"enabled\": false, \"masked\": true, \"daemon_reload\": true}, \"loop\": [\"libvirtd.service\", \"virtlogd.socket\"], \"when\": [\"libvirt_installed.rc == 0\"]}]}, {\"name\": \"Host packages setup step2\", \"tags\": \"setup_packages\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Special treatment for OpenvSwitch\", \"tripleo_ovs_upgrade\": null, \"register\": \"ovs_upgrade\"}, {\"name\": \"Always ensure the openvswitch service is enabled and running after upgrades\", \"service\": {\"name\": \"openvswitch\", \"enabled\": true, \"state\": \"started\"}, \"when\": [\"ovs_upgrade.changed|bool\"]}]}, {\"name\": \"Host packages setup step3\", \"tags\": \"setup_packages\", \"when\": \"step|int == 3\", \"block\": [{\"name\": \"Check for os-net-config upgrade\", \"shell\": \"yum check-upgrade | awk '/os-net-config/{print}'\", \"register\": \"os_net_config_need_upgrade\"}, {\"name\": \"Check that os-net-config has legacy configuration\", \"stat\": {\"path\": \"/etc/os-net-config/config.json\", \"get_attributes\": false, \"get_checksum\": false, \"get_mime\": false}, \"register\": \"stat_config_json\"}, {\"name\": \"Check that os-net-config has new configuration\", \"stat\": {\"path\": \"/etc/os-net-config/config.yaml\", \"get_attributes\": false, \"get_checksum\": false, \"get_mime\": false}, \"register\": \"stat_config_yaml\"}, {\"name\": \"Slurp the os-net-config config.json\", \"slurp\": {\"src\": \"/etc/os-net-config/config.json\"}, \"register\": \"os_config_json\", \"when\": [\"stat_config_json.stat.exists\", \"not stat_config_yaml.stat.exists\"]}, {\"name\": \"Write updated /etc/os-net-config/config.yaml\", \"copy\": {\"content\": \"{{ os_config_json.content | b64decode | from_json | to_yaml }}\", \"dest\": \"/etc/os-net-config/config.yaml\"}, \"when\": [\"stat_config_json.stat.exists\", \"not stat_config_yaml.stat.exists\"]}, {\"name\": \"Remove legacy os-net-config configuration\", \"command\": \"mv /etc/os-net-config/config.json /etc/os-net-config/deprecated_config.json\", \"when\": [\"stat_config_json.stat.exists\"]}, {\"block\": [{\"name\": \"Upgrade os-net-config\", \"package\": \"name=os-net-config state=latest\"}, {\"name\": \"take new os-net-config parameters into account now\", \"command\": \"os-net-config --no-activate -c /etc/os-net-config/config.yaml -v --detailed-exit-codes\", \"register\": \"os_net_config_upgrade\", \"failed_when\": \"os_net_config_upgrade.rc not in [0,2]\", \"changed_when\": \"os_net_config_upgrade.rc == 2\"}], \"when\": [\"os_net_config_need_upgrade.stdout\", \"stat_config_yaml.stat.exists or stat_config_json.stat.exists\"]}, {\"name\": \"Update all packages\", \"when\": [\"not skip_package_update|bool\"], \"yum\": {\"name\": \"*\", \"state\": \"latest\", \"exclude\": \"ansible-core\"}, \"vars\": {\"skip_package_update\": {\"get_param\": \"SkipPackageUpdate\"}}}, {\"name\": \"Always ensure the openvswitch service is enabled and running after upgrades rhbz#2329821\", \"service\": {\"name\": \"openvswitch\", \"enabled\": true, \"state\": \"started\"}}]}], {\"if\": [\"podman_requires_login\", {\"get_attr\": [\"Podman\", \"role_data\", \"workaround_upgrade_tasks\"]}, []]}]}, \"external_upgrade_tasks\": [{\"name\": \"Clean up upgrade artifacts\", \"when\": \"step|int == 1\", \"tags\": [\"never\", \"system_upgrade_cleanup\"], \"block\": [{\"name\": \"cleanup tripleo_persist\", \"include_role\": {\"name\": \"tripleo_persist\", \"tasks_from\": \"cleanup.yml\"}}]}], \"update_tasks\": [{\"name\": \"Enforce RHOSP rules regarding subscription.\", \"include_role\": {\"name\": \"tripleo_redhat_enforce\"}, \"vars\": {\"skip_rhel_enforcement\": {\"get_param\": \"SkipRhelEnforcement\"}}, \"when\": [\"step|int == 0\", \"ansible_facts['distribution'] == 'RedHat'\", \"not (skip_rhel_enforcement | bool)\"]}, {\"name\": \"Ensure DNF modules have the right stream enabled\", \"vars\": {\"dnf_module_list\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"dnf_module_list\"]}}, \"tripleo_dnf_stream\": {\"name\": \"{{ item.module }}:{{ item.stream }}\", \"state\": \"enabled\"}, \"loop\": \"{{ dnf_module_list|list }}\", \"when\": [\"step|int == 0\", \"dnf_module_list|length > 0\", \"item.distribution_version is defined\", \"ansible_facts['distribution_major_version'] is version(item.distribution_version, '==')\"]}, {\"name\": \"Check for existing yum.pid\", \"stat\": \"path=/run/yum.pid\", \"register\": \"yum_pid_file\", \"when\": \"step|int == 0 or step|int == 3\"}, {\"name\": \"Exit if existing yum process\", \"fail\": \"msg=\\\"ERROR existing yum.pid detected - can't continue! Please ensure there is no other package update process for the duration of the minor update worfklow. Exiting.\\\"\", \"when\": \"(step|int == 0 or step|int == 3) and yum_pid_file.stat.exists\"}, {\"name\": \"Special treatment for OpenvSwitch\", \"tripleo_ovs_upgrade\": null, \"when\": [\"step|int == 2\"], \"register\": \"ovs_upgrade\"}, {\"name\": \"Always ensure the openvswitch service is enabled and running after upgrades\", \"service\": {\"name\": \"openvswitch\", \"enabled\": true, \"state\": \"started\"}, \"when\": [\"step|int == 2\", \"ovs_upgrade.changed|bool\"]}, {\"name\": \"Update packages and EFI grub.cfg\", \"when\": [\"step|int == 3\", \"not skip_package_update|bool\"], \"block\": [{\"name\": \"Update all packages\", \"yum\": {\"name\": \"*\", \"state\": \"latest\", \"exclude\": \"ansible-core\"}}, {\"name\": \"Replace EFI grub.cfg with redirect to /boot/grub2/grub.cfg\", \"import_role\": {\"name\": \"tripleo_kernel\", \"tasks_from\": \"efigrub.yml\"}}], \"vars\": {\"skip_package_update\": {\"get_param\": \"SkipPackageUpdate\"}}}, {\"name\": \"Ensure openvswitch is running after update\", \"when\": \"step|int == 3\", \"service\": {\"name\": \"openvswitch\", \"enabled\": true, \"state\": \"started\"}, \"ignore_errors\": true}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/container-image-prepare/container-image-prepare-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Prepare container images\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerImagePrepare\": {\"default\": {}, \"description\": \"Used to run \\\"openstack tripleo container image prepare\\\". This is run after the registry is installed to populate the registry with images.\", \"type\": \"json\"}, \"ContainerImagePrepareLogFile\": {\"default\": \"/var/log/tripleo-container-image-prepare.log\", \"type\": \"string\", \"description\": \"Used to store outputs of \\\"openstack tripleo container image prepare\\\".\"}, \"DockerInsecureRegistryAddress\": {\"description\": \"Optional. The IP Address and Port of an insecure docker namespace that will be configured in /etc/sysconfig/docker. The value can be multiple addresses separated by commas.\", \"type\": \"comma_delimited_list\", \"default\": []}, \"NeutronMechanismDrivers\": {\"default\": \"ovn\", \"description\": \"The mechanism drivers for the Neutron tenant network.\\n\", \"type\": \"comma_delimited_list\"}, \"DockerRegistryMirror\": {\"description\": \"Optional. Mirror to use for registry docker.io\", \"default\": \"\", \"type\": \"string\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"ContainerImagePrepareDebug\": {\"default\": false, \"description\": \"Whether or not we want to activate --debug in tripleo container image prepare.\", \"type\": \"boolean\"}, \"ContainerImageRegistryCredentials\": {\"type\": \"json\", \"hidden\": true, \"default\": {}, \"description\": \"Mapping of image registry hosts to login credentials. Must be in the following example format\\n\\n  docker.io:\\n    username: pa55word\\n  '192.0.2.1:8787':\\n    registry_username: password\\n\"}, \"AdditionalArchitectures\": {\"default\": [], \"description\": \"List of additional architectures to enable.\", \"type\": \"comma_delimited_list\"}, \"StandaloneContainerImagePrepare\": {\"description\": \"Used to run \\\"openstack tripleo container image prepare\\\". This is run after the registry is installed to populate the registry with images. This is used for a specific role and replaces the ContainerImagePrepare parameter.\", \"type\": \"json\", \"default\": {}}, \"StandaloneServices\": {\"description\": \"A list of service resources (configured in the Heat resource_registry) which represent nested stacks for each service that should get installed on the Standalone role.\", \"type\": \"comma_delimited_list\"}, \"StandaloneCount\": {\"description\": \"Number of Standalone nodes to deploy\", \"type\": \"number\", \"default\": 1}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for container image prepare\", \"value\": {\"service_name\": \"container_image_prepare\", \"external_deploy_tasks\": [{\"name\": \"Run tripleo-container-image-prepare role\", \"import_role\": {\"name\": \"tripleo_container_image_prepare\"}, \"vars\": {\"tripleo_container_image_prepare_log_file\": {\"get_param\": \"ContainerImagePrepareLogFile\"}, \"tripleo_container_image_prepare_debug\": {\"if\": [{\"get_param\": \"ContainerImagePrepareDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"tripleo_container_image_prepare_roles\": [{\"name\": \"Standalone\", \"description\": \"A standalone role that a minimal set of services. This can be used for\\ntesting in a single node configuration with the\\n'openstack tripleo deploy --standalone' command or via an Undercloud using\\n'openstack overcloud deploy'.\\n\", \"CountDefault\": 1, \"tags\": [\"primary\", \"controller\", \"standalone\"], \"default_route_networks\": [], \"networks\": {\"External\": {\"subnet\": \"external_subnet\"}, \"InternalApi\": {\"subnet\": \"internal_api_subnet\"}, \"Storage\": {\"subnet\": \"storage_subnet\"}, \"StorageMgmt\": {\"subnet\": \"storage_mgmt_subnet\"}, \"StorageNFS\": {\"subnet\": \"storage_nfs_subnet\"}, \"Tenant\": {\"subnet\": \"tenant_subnet\"}}, \"RoleParametersDefault\": {\"OVNCMSOptions\": \"enable-chassis-as-gw\"}, \"ServicesDefault\": [\"OS::TripleO::Services::Aide\", \"OS::TripleO::Services::AodhApi\", \"OS::TripleO::Services::AodhEvaluator\", \"OS::TripleO::Services::AodhListener\", \"OS::TripleO::Services::AodhNotifier\", \"OS::TripleO::Services::AuditD\", \"OS::TripleO::Services::BootParams\", \"OS::TripleO::Services::BarbicanApi\", \"OS::TripleO::Services::BarbicanBackendDogtag\", \"OS::TripleO::Services::BarbicanBackendKmip\", \"OS::TripleO::Services::BarbicanBackendPkcs11Crypto\", \"OS::TripleO::Services::BarbicanBackendSimpleCrypto\", \"OS::TripleO::Services::CACerts\", \"OS::TripleO::Services::CeilometerAgentCentral\", \"OS::TripleO::Services::CeilometerAgentNotification\", \"OS::TripleO::Services::CephClient\", \"OS::TripleO::Services::CephExternal\", \"OS::TripleO::Services::CephGrafana\", \"OS::TripleO::Services::CephMds\", \"OS::TripleO::Services::CephMgr\", \"OS::TripleO::Services::CephMon\", \"OS::TripleO::Services::CephNfs\", \"OS::TripleO::Services::CephRbdMirror\", \"OS::TripleO::Services::CephRgw\", \"OS::TripleO::Services::CephOSD\", \"OS::TripleO::Services::CinderApi\", \"OS::TripleO::Services::CinderBackendDellEMCPowerFlex\", \"OS::TripleO::Services::CinderBackendDellEMCPowermax\", \"OS::TripleO::Services::CinderBackendDellEMCPowerStore\", \"OS::TripleO::Services::CinderBackendDellEMCSc\", \"OS::TripleO::Services::CinderBackendDellEMCUnity\", \"OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI\", \"OS::TripleO::Services::CinderBackendDellEMCVNX\", \"OS::TripleO::Services::CinderBackendDellEMCVxFlexOS\", \"OS::TripleO::Services::CinderBackendDellEMCXtremio\", \"OS::TripleO::Services::CinderBackendDellSc\", \"OS::TripleO::Services::CinderBackendNVMeOF\", \"OS::TripleO::Services::CinderBackendPure\", \"OS::TripleO::Services::CinderBackendNetApp\", \"OS::TripleO::Services::CinderBackendScaleIO\", \"OS::TripleO::Services::CinderBackup\", \"OS::TripleO::Services::CinderHPELeftHandISCSI\", \"OS::TripleO::Services::CinderScheduler\", \"OS::TripleO::Services::CinderVolume\", \"OS::TripleO::Services::Clustercheck\", \"OS::TripleO::Services::Collectd\", \"OS::TripleO::Services::ComputeCeilometerAgent\", \"OS::TripleO::Services::CeilometerAgentIpmi\", \"OS::TripleO::Services::ContainerImagePrepare\", \"OS::TripleO::Services::ContainersLogrotateCrond\", \"OS::TripleO::Services::DesignateApi\", \"OS::TripleO::Services::DesignateCentral\", \"OS::TripleO::Services::DesignateMDNS\", \"OS::TripleO::Services::DesignateProducer\", \"OS::TripleO::Services::DesignateSink\", \"OS::TripleO::Services::DesignateBind\", \"OS::TripleO::Services::DesignateWorker\", \"OS::TripleO::Services::DockerRegistry\", \"OS::TripleO::Services::Etcd\", \"OS::TripleO::Services::ExternalSwiftProxy\", \"OS::TripleO::Services::Frr\", \"OS::TripleO::Services::GlanceApi\", \"OS::TripleO::Services::GlanceApiInternal\", \"OS::TripleO::Services::GnocchiApi\", \"OS::TripleO::Services::GnocchiMetricd\", \"OS::TripleO::Services::GnocchiStatsd\", \"OS::TripleO::Services::HAproxy\", \"OS::TripleO::Services::HeatApi\", \"OS::TripleO::Services::HeatApiCfn\", \"OS::TripleO::Services::HeatApiCloudwatch\", \"OS::TripleO::Services::HeatEngine\", \"OS::TripleO::Services::Horizon\", \"OS::TripleO::Services::IpaClient\", \"OS::TripleO::Services::Ipsec\", \"OS::TripleO::Services::IronicApi\", \"OS::TripleO::Services::IronicConductor\", \"OS::TripleO::Services::IronicInspector\", \"OS::TripleO::Services::IronicNeutronAgent\", \"OS::TripleO::Services::IronicPxe\", \"OS::TripleO::Services::Iscsid\", \"OS::TripleO::Services::Kernel\", \"OS::TripleO::Services::Keystone\", \"OS::TripleO::Services::LoginDefs\", \"OS::TripleO::Services::ManilaApi\", \"OS::TripleO::Services::ManilaBackendCephFs\", \"OS::TripleO::Services::ManilaBackendIsilon\", \"OS::TripleO::Services::ManilaBackendNetapp\", \"OS::TripleO::Services::ManilaBackendPowerMax\", \"OS::TripleO::Services::ManilaBackendUnity\", \"OS::TripleO::Services::ManilaBackendVMAX\", \"OS::TripleO::Services::ManilaBackendVNX\", \"OS::TripleO::Services::ManilaScheduler\", \"OS::TripleO::Services::ManilaShare\", \"OS::TripleO::Services::MasqueradeNetworks\", \"OS::TripleO::Services::Memcached\", \"OS::TripleO::Services::MetricsQdr\", \"OS::TripleO::Services::Multipathd\", \"OS::TripleO::Services::MySQL\", \"OS::TripleO::Services::MySQLClient\", \"OS::TripleO::Services::NeutronApi\", \"OS::TripleO::Services::NeutronBgpVpnApi\", \"OS::TripleO::Services::NeutronBgpVpnBagpipe\", \"OS::TripleO::Services::NeutronCorePlugin\", \"OS::TripleO::Services::NeutronL2gwAgent\", \"OS::TripleO::Services::NeutronL2gwApi\", \"OS::TripleO::Services::NeutronL3Agent\", \"OS::TripleO::Services::NeutronLinuxbridgeAgent\", \"OS::TripleO::Services::NeutronMetadataAgent\", \"OS::TripleO::Services::NeutronOvsAgent\", \"OS::TripleO::Services::NeutronSfcApi\", \"OS::TripleO::Services::NeutronSriovAgent\", \"OS::TripleO::Services::NeutronDhcpAgent\", \"OS::TripleO::Services::NeutronVppAgent\", \"OS::TripleO::Services::NovaApi\", \"OS::TripleO::Services::NovaConductor\", \"OS::TripleO::Services::NovaIronic\", \"OS::TripleO::Services::NovaMetadata\", \"OS::TripleO::Services::NovaScheduler\", \"OS::TripleO::Services::NovaCompute\", \"OS::TripleO::Services::NovaLibvirt\", \"OS::TripleO::Services::NovaMigrationTarget\", \"OS::TripleO::Services::NovaVncProxy\", \"OS::TripleO::Services::OVNController\", \"OS::TripleO::Services::OVNDBs\", \"OS::TripleO::Services::OVNMetadataAgent\", \"OS::TripleO::Services::OctaviaApi\", \"OS::TripleO::Services::OctaviaDeploymentConfig\", \"OS::TripleO::Services::OctaviaHealthManager\", \"OS::TripleO::Services::OctaviaHousekeeping\", \"OS::TripleO::Services::OctaviaWorker\", \"OS::TripleO::Services::OpenStackClients\", \"OS::TripleO::Services::OsloMessagingNotify\", \"OS::TripleO::Services::OsloMessagingRpc\", \"OS::TripleO::Services::Pacemaker\", \"OS::TripleO::Services::PlacementApi\", \"OS::TripleO::Services::Podman\", \"OS::TripleO::Services::Redis\", \"OS::TripleO::Services::Rhsm\", \"OS::TripleO::Services::Rsyslog\", \"OS::TripleO::Services::RsyslogSidecar\", \"OS::TripleO::Services::Securetty\", \"OS::TripleO::Services::Snmp\", \"OS::TripleO::Services::Sshd\", \"OS::TripleO::Services::SwiftDispersion\", \"OS::TripleO::Services::SwiftProxy\", \"OS::TripleO::Services::SwiftRingBuilder\", \"OS::TripleO::Services::SwiftStorage\", \"OS::TripleO::Services::Timesync\", \"OS::TripleO::Services::Timezone\", \"OS::TripleO::Services::Tmpwatch\", \"OS::TripleO::Services::TripleoFirewall\", \"OS::TripleO::Services::TripleoPackages\", \"OS::TripleO::Services::Unbound\", \"OS::TripleO::Services::Tuned\", \"OS::TripleO::Services::Vpp\"]}], \"tripleo_container_image_prepare_content\": {\"parameter_defaults\": {\"ContainerImagePrepare\": {\"get_param\": \"ContainerImagePrepare\"}, \"DockerInsecureRegistryAddress\": {\"get_param\": \"DockerInsecureRegistryAddress\"}, \"NeutronMechanismDrivers\": {\"get_param\": \"NeutronMechanismDrivers\"}, \"DockerRegistryMirror\": {\"get_param\": \"DockerRegistryMirror\"}, \"ContainerImageRegistryCredentials\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"AdditionalArchitectures\": {\"get_param\": \"AdditionalArchitectures\"}, \"StandaloneContainerImagePrepare\": {\"get_param\": \"StandaloneContainerImagePrepare\"}, \"StandaloneServices\": {\"get_param\": \"StandaloneServices\"}, \"StandaloneCount\": {\"get_param\": \"StandaloneCount\"}}}}, \"when\": [\"(step | int) == 1\"]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/pacemaker/clustercheck-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"MySQL HA clustercheck service deployment using puppet This service is used by HAProxy in a HA scenario to report whether the local galera node is synced\\n\", \"parameters\": {\"ContainerClustercheckImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerClustercheckConfigImage\": {\"description\": \"The container image to use for the clustercheck config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ClustercheckListener\": {\"default\": \"socat\", \"description\": \"How to expose the clustercheck service over TCP\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"socat\", \"xinetd\"]}]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MysqlPuppetBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-pacemaker-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerClustercheckImage\": \"ContainerClustercheckImage\", \"ContainerClustercheckConfigImage\": \"ContainerClustercheckConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerClustercheckImage\": {\"get_param\": \"ContainerClustercheckImage\"}, \"ContainerClustercheckConfigImage\": {\"get_param\": \"ContainerClustercheckConfigImage\"}}}]}}}}, \"conditions\": {\"socat_listener\": {\"equals\": [{\"get_param\": \"ClustercheckListener\"}, \"socat\"]}}, \"outputs\": {\"role_data\": {\"description\": \"Containerized service clustercheck using composable services.\", \"value\": {\"service_name\": \"clustercheck\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"MysqlPuppetBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::profile::pacemaker::clustercheck::bind_address\": {\"str_replace\": {\"template\": \"%{hiera('$FQDN$NETWORK')}\", \"params\": {\"$FQDN\": {\"if\": [\"socat_listener\", \"\", \"fqdn_\"]}, \"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"MysqlNetwork\"]}}}}}]}, \"puppet_config\": {\"config_volume\": \"clustercheck\", \"puppet_tags\": \"file\", \"step_config\": \"include tripleo::profile::pacemaker::clustercheck\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerClustercheckConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/clustercheck.json\": {\"command\": {\"if\": [\"socat_listener\", \"bash -c $* -- eval source /etc/sysconfig/clustercheck; exec socat -T\\\"${TRIPLEO_HEALTHCHECK_TIMEOUT:-2}\\\" \\\"$TRIPLEO_SOCAT_BIND\\\" system:\\\"grep -qPe \\\\\\\"^\\\\\\\\r\\\\$\\\\\\\" && /usr/bin/clustercheck\\\"\", \"/usr/sbin/xinetd -dontfork\"]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_2\": {\"clustercheck\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerClustercheckImage\"]}, \"restart\": \"always\", \"net\": \"host\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/clustercheck.json:/var/lib/kolla/config_files/config.json\", \"/var/lib/config-data/puppet-generated/clustercheck:/var/lib/kolla/config_files/src:ro\", \"/var/lib/mysql:/var/lib/mysql\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": null, \"upgrade_tasks\": null, \"update_tasks\": null, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop clustercheck container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"clustercheck\"], \"tripleo_delegate_to\": \"{{ groups['clustercheck'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/logrotate/tmpwatch-install.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Install tmpwatch\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for tmpwatch install\", \"value\": {\"service_name\": \"logrotate_tmpwatch\", \"host_prep_tasks\": [{\"name\": \"install tmpwatch on the host\", \"package\": {\"name\": \"tmpwatch\", \"state\": \"installed\"}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/barbican-api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Barbican API service\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerBarbicanApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerBarbicanApiImage\": \"ContainerBarbicanApiImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerBarbicanApiImage\": {\"get_param\": \"ContainerBarbicanApiImage\"}}}]}}}}, \"outputs\": {\"cmd_extra_args\": {\"description\": \"Extra command line arguments for running the service in the container.\", \"value\": \"\"}, \"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/barbican:/var/log/barbican:z\", \"/var/log/containers/httpd/barbican-api:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"barbican_init_log\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [\"/var/log/containers/barbican:/var/log/barbican:z\", \"/var/log/containers/httpd/barbican-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R barbican:barbican /var/log/barbican\"]}}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/barbican\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/barbican-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/glance-api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Glance API service\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerGlanceApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerGlanceApiImage\": \"ContainerGlanceApiImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerGlanceApiImage\": {\"get_param\": \"ContainerGlanceApiImage\"}}}]}}}}, \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/glance:/var/log/glance:z\", \"/var/log/containers/httpd/glance:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"glance_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGlanceApiImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/glance:/var/log/glance:z\", \"/var/log/containers/httpd/glance:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R glance:glance /var/log/glance\"]}}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent logs directory\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/glance\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/glance\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/haproxy.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized HAProxy API service\\n\", \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": null}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_1\": {}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": null}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/heat-api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Heat API service\\n\", \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {}}}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/heat:/var/log/heat:z\", \"/var/log/containers/httpd/heat-api:/var/log/httpd:z\"]}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/heat\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/heat-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/heat-api-cfn.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Heat API CFN service\\n\", \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {}}}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/heat:/var/log/heat:z\", \"/var/log/containers/httpd/heat-api-cfn:/var/log/httpd:z\"]}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/heat\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/heat-api-cfn\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/heat-engine.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Glance API service\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerHeatEngineImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerHeatEngineImage\": \"ContainerHeatEngineImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerHeatEngineImage\": {\"get_param\": \"ContainerHeatEngineImage\"}}}]}}}}, \"outputs\": {\"cmd_extra_args\": {\"description\": \"Extra command line arguments for running the service in the container.\", \"value\": \"\"}, \"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"heat_init_log\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerHeatEngineImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [\"/var/log/containers/heat:/var/log/heat:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R heat:heat /var/log/heat\"]}}}}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/heat:/var/log/heat:z\"]}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/heat\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/keystone.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Keystone service\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerKeystoneImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerKeystoneImage\": \"ContainerKeystoneImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerKeystoneImage\": {\"get_param\": \"ContainerKeystoneImage\"}}}]}}}}, \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/keystone:/var/log/keystone:z\", \"/var/log/containers/httpd/keystone:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"keystone_init_log\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerKeystoneImage\"]}, \"net\": \"none\", \"user\": \"root\", \"command\": [\"/bin/bash\", \"-c\", \"chown -R keystone:keystone /var/log/keystone\"], \"volumes\": [\"/var/log/containers/keystone:/var/log/keystone:z\", \"/var/log/containers/httpd/keystone:/var/log/httpd:z\"]}}}}, \"environment\": {\"description\": \"Extra environment variables needed for the service to log to files.\", \"value\": null}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/keystone\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/keystone\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/neutron-api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Neutron API service\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerNeutronApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"NeutronServiceName\": {\"description\": \"service name\", \"type\": \"string\"}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronApiImage\": \"ContainerNeutronApiImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronApiImage\": {\"get_param\": \"ContainerNeutronApiImage\"}}}]}}}}, \"outputs\": {\"cmd_extra_args\": {\"description\": \"Extra command line arguments for running the service in the container.\", \"value\": {\"str_replace\": {\"template\": \"--log-file=/var/log/neutron/SERVICE.log\", \"params\": {\"SERVICE\": {\"get_param\": \"NeutronServiceName\"}}}}}, \"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"extra volumes\", \"value\": [\"/var/log/containers/neutron:/var/log/neutron:z\", \"/var/log/containers/httpd/neutron-api:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"neutron_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronApiImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/neutron:/var/log/neutron:z\", \"/var/log/containers/httpd/neutron-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R neutron:neutron /var/log/neutron\"]}}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/neutron\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/neutron-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/neutron-common.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Neutron service\\n\", \"parameters\": {\"NeutronServiceName\": {\"description\": \"service name\", \"type\": \"string\"}}, \"outputs\": {\"cmd_extra_args\": {\"description\": \"Extra command line arguments for running the service in the container.\", \"value\": {\"str_replace\": {\"template\": \"--log-file=/var/log/neutron/SERVICE.log\", \"params\": {\"SERVICE\": {\"get_param\": \"NeutronServiceName\"}}}}}, \"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {}}}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/neutron:/var/log/neutron:z\"]}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/neutron\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/nova-api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Template for nova-api's logging to files\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerNovaApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaApiImage\": \"ContainerNovaApiImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaApiImage\": {\"get_param\": \"ContainerNovaApiImage\"}}}]}}}}, \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/nova:/var/log/nova:z\", \"/var/log/containers/httpd/nova-api:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"nova_api_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaApiImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/nova:/var/log/nova:z\", \"/var/log/containers/httpd/nova-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R nova:nova /var/log/nova\"], \"environment\": {\"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"setype\": \"{{ item.setype }}\", \"state\": \"directory\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/nova\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/nova-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/nova-metadata.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Template for nova-metadata's logging to files\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerNovaMetadataImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNovaMetadataImage\": \"ContainerNovaMetadataImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNovaMetadataImage\": {\"get_param\": \"ContainerNovaMetadataImage\"}}}]}}}}, \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/nova:/var/log/nova:z\", \"/var/log/containers/httpd/nova-metadata:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"nova_metadata_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNovaMetadataImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/nova:/var/log/nova:z\", \"/var/log/containers/httpd/nova-metadata:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R nova:nova /var/log/nova\"]}}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/nova\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/nova-metadata\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/nova-libvirt.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Nova libvirt service\\n\", \"parameters\": {\"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"LibvirtDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging libvirt services.\"}, \"LibvirtLogLevel\": {\"default\": 3, \"description\": \"Defines log level in libvirt to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}, \"LibvirtVirtlogdLogLevel\": {\"default\": 3, \"description\": \"Defines log level in virtlogd to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}, \"LibvirtVirtsecretdLogLevel\": {\"default\": 3, \"description\": \"Defines log level in virtsecretd to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}, \"LibvirtVirtnodedevdLogLevel\": {\"default\": 3, \"description\": \"Defines log level in virtnodedevd to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}, \"LibvirtVirtqemudLogLevel\": {\"default\": 3, \"description\": \"Defines log level in virtqemud to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}, \"LibvirtVirtproxydLogLevel\": {\"default\": 3, \"description\": \"Defines log level in virtproxyd to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}, \"LibvirtVirtstoragedLogLevel\": {\"default\": 3, \"description\": \"Defines log level in virtstoraged to filter log output. See https://libvirt.org/logging.html to find its detail.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 4}}]}}, \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": {\"nova::compute::libvirt::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/libvirtd.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtLogLevel\"}]}}}}, \"nova::compute::libvirt::virtlogd::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/virtlogd.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtVirtlogdLogLevel\"}]}}}}, \"nova::compute::libvirt::virtsecretd::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/virtsecretd.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtVirtsecretdLogLevel\"}]}}}}, \"nova::compute::libvirt::virtnodedevd::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/virtnodedevd.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtVirtnodedevdLogLevel\"}]}}}}, \"nova::compute::libvirt::virtqemud::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/virtqemud.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtVirtqemudLogLevel\"}]}}}}, \"nova::compute::libvirt::virtproxyd::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/virtproxyd.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtVirtproxydLogLevel\"}]}}}}, \"nova::compute::libvirt::virtstoraged::log_outputs\": {\"str_replace\": {\"template\": \"LEVEL:file:/var/log/libvirt/virtstoraged.log\", \"params\": {\"LEVEL\": {\"if\": [{\"or\": [{\"get_param\": \"Debug\"}, {\"get_param\": \"LibvirtDebug\"}]}, 1, {\"get_param\": \"LibvirtVirtstoragedLogLevel\"}]}}}}}}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/libvirt:/var/log/libvirt:shared,z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to file in the host.\", \"value\": null}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"setype\": \"{{ item.setype }}\", \"state\": \"directory\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/libvirt\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/files/placement-api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Template for placement's logging to files\\n\", \"parameters\": {\"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ContainerPlacementImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerPlacementImage\": \"ContainerPlacementImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerPlacementImage\": {\"get_param\": \"ContainerPlacementImage\"}}}]}}}}, \"outputs\": {\"config_settings\": {\"description\": \"Extra hieradata needed to log to files in the host.\", \"value\": null}, \"volumes\": {\"description\": \"The volumes needed to log to files in the host.\", \"value\": [\"/var/log/containers/placement:/var/log/placement:z\", \"/var/log/containers/httpd/placement:/var/log/httpd:z\"]}, \"docker_config\": {\"description\": \"Extra containers needed for logging to files in the host.\", \"value\": {\"step_2\": {\"placement_init_log\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerPlacementImage\"]}, \"net\": \"none\", \"user\": \"root\", \"command\": [\"/bin/bash\", \"-c\", \"chown -R placement:placement /var/log/placement\"], \"volumes\": [\"/var/log/containers/placement:/var/log/placement:z\", \"/var/log/containers/httpd/placement:/var/log/httpd:z\"]}}}}, \"host_prep_tasks\": {\"description\": \"Extra ansible tasks needed for logging to files in the host.\", \"value\": [{\"name\": \"create persistent logs directory\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/placement\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/placement\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}]}}}", "file:///root/tripleo-heat-installer-templates/deployment/kernel/kernel-boot-params-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Host config and reboot service which configures Kernel Args and reboot\", \"parameters\": {\"RoleNetIpMap\": {\"default\": {}, \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"KernelArgs\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Kernel Args to apply to the host\", \"tags\": [\"role_specific\"]}, \"KernelArgsDeferReboot\": {\"default\": false, \"type\": \"boolean\", \"description\": \"When enabled, nodes will not get rebooted automatically by tripleo-kernel if KernelArgs have been changed. Operators will have to manually reboot nodes after the deployment or update process is completed.\\nLeaving this enabled during a scale-up operation will prevent reboot on new nodes. This might cause deployment errors as the KernelArgs will not be applied.\\n\", \"tags\": [\"role_specific\"]}, \"TunedProfileName\": {\"default\": \"throughput-performance\", \"type\": \"string\", \"description\": \"Tuned Profile to apply to the host\", \"tags\": [\"role_specific\"]}, \"IsolCpusList\": {\"default\": \"\", \"type\": \"string\", \"description\": \"List of logical CPU ids whic need to be isolated from the host processes. This input is provided to the tuned profile cpu-partitioning to configure systemd and repin interrupts (IRQ repinning).\\n\", \"tags\": [\"role_specific\"]}, \"NodeRebootWaitTimeout\": {\"default\": 900, \"type\": \"number\", \"description\": \"Timeout in seconds to specify the wait time for ansible node reboot\"}, \"Hugepages\": {\"default\": {}, \"type\": \"json\", \"description\": \"Hash for hugepage configuration Example:\\n  Hugepages:\\n    2048:\\n      count: 100\\n      default: false\\n    1048576:\\n      count: 100\\n      default: true\\n\", \"tags\": [\"role_specific\"]}, \"ReconfigureHugepages\": {\"default\": false, \"type\": \"boolean\", \"description\": \"By default, tripleo-kernel will configure the provided Hugepages as specified by operators but it won't try to remove Hugepages configured on the host that are not part of the TripleO paramater. Enabling this setting will make sure everything is reconfigured exactly like the TripleO parameter, otherwise we just add the content of the Hugepages parameter to what's already in place.\\n\", \"tags\": [\"role_specific\"]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"tuned_profile\": \"TunedProfileName\", \"isolated_cores\": \"IsolCpusList\", \"kernel_args\": \"KernelArgs\", \"kernel_args_defer_reboot\": \"KernelArgsDeferReboot\", \"hugepages\": \"Hugepages\", \"reconfigure_hugepages\": \"ReconfigureHugepages\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"TunedProfileName\": {\"get_param\": \"TunedProfileName\"}, \"IsolCpusList\": {\"get_param\": \"IsolCpusList\"}, \"KernelArgs\": {\"get_param\": \"KernelArgs\"}, \"KernelArgsDeferReboot\": {\"get_param\": \"KernelArgsDeferReboot\"}, \"Hugepages\": {\"get_param\": \"Hugepages\"}, \"ReconfigureHugepages\": {\"get_param\": \"ReconfigureHugepages\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Host Config Service\", \"value\": {\"service_name\": \"boot_params_service\", \"deploy_steps_tasks\": [{\"name\": \"Configure tuned before reboot\", \"when\": \"step|int == 0\", \"include_role\": {\"name\": \"tuned\"}, \"vars\": {\"tuned_profile\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"tuned_profile\"]}, \"tuned_isolated_cores\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"isolated_cores\"]}}}, {\"name\": \"Configure kernel args and reboot\", \"when\": \"step|int == 0\", \"include_role\": {\"name\": \"tripleo_kernel\", \"tasks_from\": \"kernelargs.yml\"}, \"vars\": {\"tripleo_kernel_args\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"kernel_args\"]}, \"tripleo_kernel_hugepages\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"hugepages\"]}, \"tripleo_kernel_hugepages_remove\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"reconfigure_hugepages\"]}, \"tripleo_kernel_defer_reboot\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"kernel_args_defer_reboot\"]}, \"tripleo_kernel_reboot_timeout\": {\"get_param\": \"NodeRebootWaitTimeout\"}}}], \"upgrade_tasks\": [{\"name\": \"upgrade prepare for leapp to align kernel arg shortcommings in leapp\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_prepare\"], \"when\": [\"step|int == 3\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"fix grub entries to have name start with GRUB_\", \"replace\": {\"path\": \"/etc/default/grub\", \"regexp\": \"^(TRIPLEO_HEAT_TEMPLATE_KERNEL_ARGS)(.*)\", \"replace\": \"GRUB_\\\\1\\\\2\"}}, {\"name\": \"fix grub entries in append statement\", \"replace\": {\"path\": \"/etc/default/grub\", \"regexp\": \"(.*){(TRIPLEO_HEAT_TEMPLATE_KERNEL_ARGS)}(.*)\", \"replace\": \"\\\\1{GRUB_\\\\2}\\\\3\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployed-server/deployed-server.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"image\": {\"type\": \"string\", \"default\": \"unused\"}, \"flavor\": {\"type\": \"string\", \"default\": \"unused\"}, \"key_name\": {\"type\": \"string\", \"default\": \"unused\", \"description\": \"Name of keypair to assign to servers\"}, \"security_groups\": {\"type\": \"json\", \"default\": []}, \"user_data_format\": {\"type\": \"string\"}, \"user_data\": {\"type\": \"string\", \"default\": \"\"}, \"name\": {\"type\": \"string\", \"default\": \"deployed-server\"}, \"image_update_policy\": {\"type\": \"string\", \"default\": \"\"}, \"networks\": {\"type\": \"comma_delimited_list\", \"default\": \"\"}, \"metadata\": {\"type\": \"json\", \"default\": {}}, \"software_config_transport\": {\"default\": \"POLL_SERVER_CFN\", \"type\": \"string\"}, \"scheduler_hints\": {\"type\": \"json\", \"description\": \"Optional scheduler hints to pass to nova\", \"default\": {}}, \"UpgradeInitCommand\": {\"type\": \"string\", \"description\": \"Command or script snippet to run on all overcloud nodes to\\ninitialize the upgrade process. E.g. a repository switch.\\n\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"UpgradeInitCommonCommand\": {\"type\": \"string\", \"description\": \"Common commands required by the upgrades process. This should not\\nnormally be modified by the operator and is set and unset in the\\nmajor-upgrade-composable-steps.yaml and major-upgrade-converge.yaml\\nenvironment files.\\n\", \"default\": \"\"}, \"ControlPlaneSubnet\": {\"default\": \"ctlplane-subnet\", \"description\": \"The name of the undercloud Neutron control plane subnet\", \"type\": \"string\"}}, \"resources\": {\"deployed-server\": {\"type\": \"OS::Heat::DeployedServer\", \"properties\": {\"name\": {\"get_param\": \"name\"}, \"software_config_transport\": {\"get_param\": \"software_config_transport\"}}}, \"ControlPlanePort\": {\"type\": \"OS::TripleO::DeployedServer::ControlPlanePort\", \"properties\": {\"network\": \"ctlplane\", \"fixed_ips\": [{\"subnet\": {\"get_param\": \"ControlPlaneSubnet\"}}], \"name\": {\"list_join\": [\"-\", [{\"get_param\": \"name\"}, \"ctlplane\"]]}, \"replacement_policy\": \"AUTO\", \"tags\": [{\"str_replace\": {\"template\": \"tripleo_stack_name=$STACK_NAME\", \"params\": {\"$STACK_NAME\": {\"get_param\": \"RootStackName\"}}}}]}}}, \"outputs\": {\"OS::stack_id\": {\"value\": {\"get_resource\": \"deployed-server\"}}, \"networks\": {\"value\": {\"ctlplane\": [{\"get_attr\": [\"ControlPlanePort\", \"fixed_ips\", 0, \"ip_address\"]}]}}, \"addresses\": {\"value\": {\"ctlplane\": [{\"subnets\": {\"get_attr\": [\"ControlPlanePort\", \"subnets\"]}}]}}, \"name\": {\"value\": {\"get_param\": \"name\"}}, \"os_collect_config\": {\"value\": {\"get_attr\": [\"deployed-server\", \"os_collect_config\"]}}}}", "file:///root/tripleo-heat-installer-templates/deployed-server/deployed-neutron-port.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \" A fake OS::Neutron::Port stack which outputs fixed_ips and subnets based on the input from the DeployedServerPortMap (set via parameter_defaults). This lookup requires the use of port naming conventions. In order for this to work with deployed-server the keys should be <hostname>-<network>. Example: parameter_defaults: DeployedServerPortMap: gatsby-ctlplane: fixed_ips: - ip_address: 127.0.0.1 subnets: - cidr: 127.0.0.0/24 network: tags: - 127.0.0.0/24\", \"parameters\": {\"name\": {\"default\": \"\", \"type\": \"string\"}, \"dns_name\": {\"default\": \"\", \"type\": \"string\"}, \"network\": {\"default\": \"\", \"type\": \"string\"}, \"fixed_ips\": {\"default\": \"\", \"type\": \"comma_delimited_list\"}, \"replacement_policy\": {\"default\": \"\", \"type\": \"string\"}, \"tags\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"DeployedServerPortMap\": {\"default\": {}, \"type\": \"json\"}, \"IsVirtualIP\": {\"default\": false, \"type\": \"boolean\"}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"outputs\": {\"fixed_ips\": {\"value\": {\"get_param\": [\"DeployedServerPortMap\", {\"get_param\": \"name\"}, \"fixed_ips\"]}}, \"subnets\": {\"value\": {\"get_param\": [\"DeployedServerPortMap\", {\"get_param\": \"name\"}, \"subnets\"]}}, \"network\": {\"value\": {\"get_param\": [\"DeployedServerPortMap\", {\"get_param\": \"name\"}, \"network\"]}}, \"name\": {\"value\": {\"get_param\": \"name\"}}, \"status\": {\"value\": \"DOWN\"}, \"allowed_address_pairs\": {\"value\": {}}, \"device_id\": {\"value\": \"\"}, \"device_owner\": {\"value\": {\"get_param\": \"network\"}}, \"dns_assignment\": {\"value\": \"\"}, \"port_security_enabled\": {\"value\": false}, \"admin_state_up\": {\"value\": false}, \"security_groups\": {\"value\": {}}, \"network_id\": {\"value\": \"\"}, \"tenant_id\": {\"value\": \"\"}, \"qos_policy_id\": {\"value\": \"\"}, \"mac_address\": {\"value\": \"\"}}}", "file:///root/tripleo-heat-installer-templates/deployment/image-serve/image-serve-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configures apache to serve container images on a host.\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"LocalContainerRegistry\": {\"default\": \"\", \"description\": \"The IP address used to bind the local container registry\", \"type\": \"string\"}}, \"conditions\": {\"local_container_registry_is_empty\": {\"equals\": [{\"get_param\": \"LocalContainerRegistry\"}, \"\"]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the image serve registry service\", \"value\": {\"service_name\": \"docker_registry\", \"firewall_rules\": {\"155 docker-registry\": {\"dport\": [8787]}}, \"firewall_frontend_rules\": {\"100 docker_registry_haproxy_frontend\": {\"dport\": [8787]}}, \"firewall_ssl_frontend_rules\": {\"100 docker_registry_haproxy_frontend_ssl\": {\"dport\": [13787]}}, \"host_prep_tasks\": [{\"name\": \"authorize httpd to listen on registry ports\", \"community.general.seport\": {\"ports\": [\"8787\", \"13787\"], \"proto\": \"tcp\", \"setype\": \"http_port_t\", \"state\": \"present\"}}, {\"name\": \"Install, Configure and Run Apache to serve container images\", \"block\": [{\"set_fact\": {\"container_registry_host\": {\"if\": [\"local_container_registry_is_empty\", {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"host\"]}, {\"get_param\": \"LocalContainerRegistry\"}]}, \"container_registry_port\": {\"get_param\": [\"EndpointMap\", \"DockerRegistryInternal\", \"port\"]}}}, {\"include_role\": {\"name\": \"tripleo_image_serve\"}}]}], \"upgrade_tasks\": [{\"name\": \"Uninstall docker-distribution\", \"when\": \"step|int == 3\", \"block\": [{\"name\": \"check if docker-distribution is installed\", \"command\": \"/usr/bin/rpm -q docker-distribution\", \"failed_when\": false, \"register\": \"docker_distribution_installed\", \"check_mode\": false}, {\"name\": \"Stop, disable docker-distribution\", \"systemd\": {\"enabled\": false, \"state\": \"stopped\", \"name\": \"docker-distribution\"}, \"when\": \"docker_distribution_installed.rc == 0\"}, {\"name\": \"Uninstall docker-distribution\", \"package\": \"name=docker-distribution state=absent\", \"when\": \"docker_distribution_installed.rc == 0\"}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/clients/openstack-clients-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Install the OpenStack clients with puppet\\n\", \"parameters\": {\"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the OpenStack clients\", \"value\": {\"service_name\": \"openstack_clients\", \"host_prep_tasks\": [{\"include_role\": {\"name\": \"tripleo_clients_install\"}}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/logging/rsyslog-baremetal-ansible.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Install and start rsyslog.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the TripleO rsyslog service.\", \"value\": {\"service_name\": \"rsyslog_baremetal_ansible\", \"config_settings\": {}, \"deploy_steps_tasks\": [], \"docker_config\": {}, \"kolla_config\": {}, \"puppet_config\": {}, \"host_prep_tasks\": [{\"name\": \"Ensure rsyslog is installed\", \"package\": {\"name\": \"rsyslog\", \"state\": \"installed\"}}, {\"name\": \"Ensure rsyslog is enabled and started\", \"systemd\": {\"state\": \"started\", \"name\": \"rsyslog\", \"enabled\": true}}]}}}}", "file:///root/tripleo-heat-installer-templates/network/deployed_networks.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Create networks to split out Overcloud traffic\", \"parameters\": {\"DeployedNetworkEnvironment\": {\"type\": \"json\", \"description\": \"Deployed network environment\"}, \"CtlplaneNetworkCidrs\": {\"type\": \"json\", \"description\": \"Cidrs for the ctlplane network.\"}, \"CtlplaneNetworkAttributes\": {\"type\": \"json\", \"default\": {}, \"description\": \"A map containing attributes of the undercloud ctlplane network and subnets. NOTE: The value for this parameter is automatically populated in the plan environment by tripleoclient.\\n\"}}, \"resources\": {\"NetworkExtraConfig\": {\"type\": \"OS::TripleO::Network::ExtraConfig\"}, \"NetworkAttributesMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"map_merge\": [{\"ctlplane\": {\"get_param\": \"CtlplaneNetworkAttributes\"}}, {\"get_param\": [\"DeployedNetworkEnvironment\", \"net_attributes_map\"]}]}}}, \"NetworkCidrMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"map_merge\": [{\"ctlplane\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, {\"get_param\": [\"DeployedNetworkEnvironment\", \"net_cidr_map\"]}]}}}, \"NetworkIpVersionMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"map_merge\": [{\"ctlplane\": {\"yaql\": {\"expression\": \"$.data.items().first().last().ip_version\", \"data\": {\"get_param\": [\"CtlplaneNetworkAttributes\", \"subnets\"]}}}}, {\"get_param\": [\"DeployedNetworkEnvironment\", \"net_ip_version_map\"]}]}}}}, \"outputs\": {\"net_cidr_map\": {\"value\": {\"get_attr\": [\"NetworkCidrMap\", \"value\"]}}, \"net_ip_version_map\": {\"value\": {\"get_attr\": [\"NetworkIpVersionMap\", \"value\"]}}, \"net_attributes_map\": {\"value\": {\"get_attr\": [\"NetworkAttributesMap\", \"value\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_storage.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed port on the Storage network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"NodePortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"DefaultRoute\": {\"description\": \"Whether this interface is used for the default route\\n\", \"type\": \"boolean\", \"default\": false}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"resources\": {\"StorageDeployedPort\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"ip_address\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"storage\", \"ip_address\"]}, \"ip_address_uri\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"storage\", \"ip_address_uri\"]}, \"ip_subnet\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"storage\", \"ip_subnet\"]}}}}}, \"outputs\": {\"ip_address\": {\"description\": \"Storage network IP\", \"value\": {\"get_attr\": [\"StorageDeployedPort\", \"value\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"Storage network IP (with brackets for IPv6 URLs)\", \"value\": {\"get_attr\": [\"StorageDeployedPort\", \"value\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the Storage network IP\", \"value\": {\"get_attr\": [\"StorageDeployedPort\", \"value\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_storage_mgmt.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed port on the StorageMgmt network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"NodePortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"DefaultRoute\": {\"description\": \"Whether this interface is used for the default route\\n\", \"type\": \"boolean\", \"default\": false}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"resources\": {\"StorageMgmtDeployedPort\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"ip_address\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"storage_mgmt\", \"ip_address\"]}, \"ip_address_uri\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"storage_mgmt\", \"ip_address_uri\"]}, \"ip_subnet\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"storage_mgmt\", \"ip_subnet\"]}}}}}, \"outputs\": {\"ip_address\": {\"description\": \"StorageMgmt network IP\", \"value\": {\"get_attr\": [\"StorageMgmtDeployedPort\", \"value\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"StorageMgmt network IP (with brackets for IPv6 URLs)\", \"value\": {\"get_attr\": [\"StorageMgmtDeployedPort\", \"value\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the StorageMgmt network IP\", \"value\": {\"get_attr\": [\"StorageMgmtDeployedPort\", \"value\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_internal_api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed port on the InternalApi network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"NodePortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"DefaultRoute\": {\"description\": \"Whether this interface is used for the default route\\n\", \"type\": \"boolean\", \"default\": false}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"resources\": {\"InternalApiDeployedPort\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"ip_address\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"internal_api\", \"ip_address\"]}, \"ip_address_uri\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"internal_api\", \"ip_address_uri\"]}, \"ip_subnet\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"internal_api\", \"ip_subnet\"]}}}}}, \"outputs\": {\"ip_address\": {\"description\": \"InternalApi network IP\", \"value\": {\"get_attr\": [\"InternalApiDeployedPort\", \"value\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"InternalApi network IP (with brackets for IPv6 URLs)\", \"value\": {\"get_attr\": [\"InternalApiDeployedPort\", \"value\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the InternalApi network IP\", \"value\": {\"get_attr\": [\"InternalApiDeployedPort\", \"value\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_tenant.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed port on the Tenant network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"NodePortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"DefaultRoute\": {\"description\": \"Whether this interface is used for the default route\\n\", \"type\": \"boolean\", \"default\": false}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"resources\": {\"TenantDeployedPort\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"ip_address\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"tenant\", \"ip_address\"]}, \"ip_address_uri\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"tenant\", \"ip_address_uri\"]}, \"ip_subnet\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"tenant\", \"ip_subnet\"]}}}}}, \"outputs\": {\"ip_address\": {\"description\": \"Tenant network IP\", \"value\": {\"get_attr\": [\"TenantDeployedPort\", \"value\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"Tenant network IP (with brackets for IPv6 URLs)\", \"value\": {\"get_attr\": [\"TenantDeployedPort\", \"value\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the Tenant network IP\", \"value\": {\"get_attr\": [\"TenantDeployedPort\", \"value\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_external.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed port on the External network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"NodePortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"DefaultRoute\": {\"description\": \"Whether this interface is used for the default route\\n\", \"type\": \"boolean\", \"default\": false}, \"Role\": {\"description\": \"The TripleO Role Name\\n\", \"type\": \"string\", \"default\": \"\"}}, \"resources\": {\"ExternalDeployedPort\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"ip_address\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"external\", \"ip_address\"]}, \"ip_address_uri\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"external\", \"ip_address_uri\"]}, \"ip_subnet\": {\"get_param\": [\"NodePortMap\", {\"get_param\": \"DnsName\"}, \"external\", \"ip_subnet\"]}}}}}, \"outputs\": {\"ip_address\": {\"description\": \"External network IP\", \"value\": {\"get_attr\": [\"ExternalDeployedPort\", \"value\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"External network IP (with brackets for IPv6 URLs)\", \"value\": {\"get_attr\": [\"ExternalDeployedPort\", \"value\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the External network IP\", \"value\": {\"get_attr\": [\"ExternalDeployedPort\", \"value\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_vip_ctlplane.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed VIP port on the Control Plane network.\\n\", \"parameters\": {\"name\": {\"default\": \"\", \"type\": \"string\"}, \"dns_name\": {\"default\": \"\", \"type\": \"string\"}, \"network\": {\"default\": \"\", \"type\": \"string\"}, \"fixed_ips\": {\"default\": \"\", \"type\": \"comma_delimited_list\"}, \"replacement_policy\": {\"default\": \"\", \"type\": \"string\"}, \"tags\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"ControlPlaneVipData\": {\"description\": \"Control Plane Virtual IP data\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"name\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"name\"]}}, \"fixed_ips\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"fixed_ips\"]}}, \"network\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"network\"]}}, \"subnets\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"subnets\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_vip_storage.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed VIP port on the Storage network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"VipPortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"ip_address\": {\"description\": \"Storage network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"storage\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"Storage network VIP (with brackets for IPv6 URLs)\", \"value\": {\"get_param\": [\"VipPortMap\", \"storage\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the Storage network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"storage\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_vip_storage_mgmt.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed VIP port on the StorageMgmt network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"VipPortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"ip_address\": {\"description\": \"StorageMgmt network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"storage_mgmt\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"StorageMgmt network VIP (with brackets for IPv6 URLs)\", \"value\": {\"get_param\": [\"VipPortMap\", \"storage_mgmt\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the StorageMgmt network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"storage_mgmt\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_vip_internal_api.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed VIP port on the InternalApi network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"VipPortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"ip_address\": {\"description\": \"InternalApi network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"internal_api\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"InternalApi network VIP (with brackets for IPv6 URLs)\", \"value\": {\"get_param\": [\"VipPortMap\", \"internal_api\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the InternalApi network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"internal_api\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/network/ports/deployed_vip_external.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed VIP port on the External network.\\n\", \"parameters\": {\"StackName\": {\"description\": \"Name of the overcloud heat stack\", \"default\": \"overcloud\", \"type\": \"string\"}, \"PortName\": {\"description\": \"Name of the port\", \"default\": \"\", \"type\": \"string\"}, \"DnsName\": {\"description\": \"DNS name of the port\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneIP\": {\"description\": \"IP address on the control plane\", \"default\": \"\", \"type\": \"string\"}, \"ControlPlaneSubnetCidr\": {\"default\": \"\", \"description\": \"The subnet CIDR of the control plane network. (The parameter is automatically resolved from the ctlplane subnet's cidr attribute.)\\n\", \"type\": \"string\"}, \"ControlPlaneNetwork\": {\"description\": \"The name of the undercloud Neutron control plane\", \"default\": \"ctlplane\", \"type\": \"string\"}, \"ControlPlaneSubnet\": {\"description\": \"The name of the undercloud Neutron control plane subnet\", \"default\": \"ctlplane-subnet\", \"type\": \"string\"}, \"FixedIPs\": {\"description\": \"Control the IP allocation for the VIP port. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"default\": [], \"type\": \"json\"}, \"IPPool\": {\"default\": {}, \"type\": \"json\"}, \"NodeIndex\": {\"default\": 0, \"type\": \"number\"}, \"IsVirtualIP\": {\"type\": \"boolean\", \"default\": false}, \"VipPortMap\": {\"description\": \"A map of deployed port data\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"ip_address\": {\"description\": \"External network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"external\", \"ip_address\"]}}, \"ip_address_uri\": {\"description\": \"External network VIP (with brackets for IPv6 URLs)\", \"value\": {\"get_param\": [\"VipPortMap\", \"external\", \"ip_address_uri\"]}}, \"ip_subnet\": {\"description\": \"IP/Subnet CIDR for the External network VIP\", \"value\": {\"get_param\": [\"VipPortMap\", \"external\", \"ip_subnet\"]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backup-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Cinder Backup service\\n\", \"parameters\": {\"ContainerCinderBackupImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCinderConfigImage\": {\"description\": \"The container image to use for the cinder config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"DockerCinderBackupLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.cinder.backup\", \"file\": \"/var/log/containers/cinder/cinder-backup.log\"}}, \"CinderBackupBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Cinder Backup backend to use.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"ceph\", \"nfs\", \"gcs\", \"s3\"]}]}, \"CinderBackupWorkers\": {\"type\": \"number\", \"default\": 1, \"description\": \"The number of cinder-backup processes to launch.\"}, \"CinderBackupMaxOperations\": {\"type\": \"number\", \"default\": 15, \"description\": \"The maximum number of concurrent cinder backup/restore operations (0 means unlimited).\"}, \"CinderBackupCompressionAlgorithm\": {\"default\": \"zlib\", \"description\": \"The compression algorithm used by Cinder Backup backends that are based on Cinder's \\\"chunked\\\" backup driver. This includes the swift, nfs, gcs and s3 backends. The ceph backend does not support the feature.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"none\", \"zlib\", \"bzip2\", \"zstd\"]}]}, \"CinderBackupRbdClusterName\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The Ceph cluster where backups are to be stored. If no value is specified then the CephClusterName value is used.\"}, \"CinderBackupRbdClientUserName\": {\"default\": \"\", \"type\": \"string\", \"description\": \"The Ceph client name used by the backup service. If no value is specified then the CephClientUserName value is used.\"}, \"CinderBackupRbdPoolName\": {\"default\": \"backups\", \"type\": \"string\"}, \"CinderBackupNfsShare\": {\"default\": \"\", \"description\": \"NFS share to be mounted\", \"type\": \"string\"}, \"CinderBackupNfsMountOptions\": {\"default\": \"context=system_u:object_r:container_file_t:s0\", \"description\": \"Mount options passed to the NFS client. See NFS man page for details.\", \"type\": \"string\"}, \"CinderBackupGcsCredentials\": {\"default\": {}, \"description\": \"The GCS service account credentials, in JSON format.\", \"type\": \"json\"}, \"CinderBackupGcsProjectId\": {\"default\": \"\", \"description\": \"The GCS project ID.\", \"type\": \"string\"}, \"CinderBackupGcsBucket\": {\"default\": \"volumebackups\", \"description\": \"The GCS bucket where backups are to be stored.\", \"type\": \"string\"}, \"CinderBackupGcsBucketLocation\": {\"default\": \"\", \"description\": \"If set, it specifies the location where the GCS bucket should be created.\", \"type\": \"string\"}, \"CinderBackupS3EndpointUrl\": {\"default\": \"\", \"description\": \"The URL where the S3 server is listening.\", \"type\": \"string\"}, \"CinderBackupS3AccessKey\": {\"default\": \"\", \"description\": \"The S3 query token access key.\", \"type\": \"string\"}, \"CinderBackupS3SecretKey\": {\"default\": \"\", \"description\": \"The S3 query token secret key.\", \"type\": \"string\"}, \"CinderBackupS3Bucket\": {\"default\": \"volumebackups\", \"description\": \"The S3 bucket where backups are to be stored.\", \"type\": \"string\"}, \"MonitoringSubscriptionCinderBackup\": {\"default\": \"overcloud-cinder-backup\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"CinderBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"CinderCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCinderBackupImage\": \"ContainerCinderBackupImage\", \"ContainerCinderConfigImage\": \"ContainerCinderConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCinderBackupImage\": {\"get_param\": \"ContainerCinderBackupImage\"}, \"ContainerCinderConfigImage\": {\"get_param\": \"ContainerCinderConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder Backup role.\", \"value\": {\"service_name\": \"cinder_backup\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCinderBackup\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CinderBase\", \"role_data\", \"config_settings\"]}, {\"cinder::backup::backup_workers\": {\"get_param\": \"CinderBackupWorkers\"}, \"cinder::backup::backup_max_operations\": {\"get_param\": \"CinderBackupMaxOperations\"}}, {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupBackend\"}, \"ceph\"]}, {\"cinder::backup::ceph::backup_ceph_user\": {\"str_replace\": {\"template\": \"USERNAME\", \"params\": {\"USERNAME\": {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupRbdClientUserName\"}, \"\"]}, {\"get_param\": \"CephClientUserName\"}, {\"get_param\": \"CinderBackupRbdClientUserName\"}]}}}}, \"cinder::backup::ceph::backup_ceph_pool\": {\"get_param\": \"CinderBackupRbdPoolName\"}, \"cinder::backup::ceph::backup_ceph_conf\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.conf\", \"params\": {\"CLUSTER\": {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupRbdClusterName\"}, \"\"]}, {\"get_param\": \"CephClusterName\"}, {\"get_param\": \"CinderBackupRbdClusterName\"}]}}}}}]}, {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupBackend\"}, \"swift\"]}, {\"cinder::backup::swift::backup_swift_container\": \"volumebackups\", \"cinder::backup::swift::backup_compression_algorithm\": {\"get_param\": \"CinderBackupCompressionAlgorithm\"}, \"cinder::backup::swift::swift_catalog_info\": \"object-store:swift:internalURL\"}]}, {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupBackend\"}, \"nfs\"]}, {\"cinder::backup::nfs::backup_share\": {\"get_param\": \"CinderBackupNfsShare\"}, \"cinder::backup::nfs::backup_mount_options\": {\"get_param\": \"CinderBackupNfsMountOptions\"}, \"cinder::backup::nfs::backup_compression_algorithm\": {\"get_param\": \"CinderBackupCompressionAlgorithm\"}}]}, {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupBackend\"}, \"gcs\"]}, {\"tripleo::profile::base::cinder::backup::gcs::credentials\": {\"get_param\": \"CinderBackupGcsCredentials\"}, \"cinder::backup::google::backup_gcs_project_id\": {\"get_param\": \"CinderBackupGcsProjectId\"}, \"cinder::backup::google::backup_gcs_bucket\": {\"get_param\": \"CinderBackupGcsBucket\"}, \"cinder::backup::google::backup_gcs_bucket_location\": {\"get_param\": \"CinderBackupGcsBucketLocation\"}, \"cinder::config::cinder_config\": {\"DEFAULT/backup_compression_algorithm\": {\"value\": {\"get_param\": \"CinderBackupCompressionAlgorithm\"}}}}]}, {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupBackend\"}, \"s3\"]}, {\"cinder::backup::s3::backup_s3_endpoint_url\": {\"get_param\": \"CinderBackupS3EndpointUrl\"}, \"cinder::backup::s3::backup_s3_store_access_key\": {\"get_param\": \"CinderBackupS3AccessKey\"}, \"cinder::backup::s3::backup_s3_store_secret_key\": {\"get_param\": \"CinderBackupS3SecretKey\"}, \"cinder::backup::s3::backup_s3_store_bucket\": {\"get_param\": \"CinderBackupS3Bucket\"}, \"cinder::backup::s3::backup_compression_algorithm\": {\"get_param\": \"CinderBackupCompressionAlgorithm\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_cinder_backup\": [{\"get_param\": \"DockerCinderBackupLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"cinder\", \"puppet_tags\": \"cinder_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [{\"get_attr\": [\"CinderBase\", \"role_data\", \"step_config\"]}, {\"str_replace\": {\"template\": \"include tripleo::profile::base::cinder::backup::DRIVER\", \"params\": {\"DRIVER\": {\"get_param\": \"CinderBackupBackend\"}}}}, {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/cinder_backup.json\": {\"command\": \"/usr/bin/cinder-backup --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf\", \"config_files\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_permissions\"]}}}, \"docker_config\": {\"step_3\": {\"cinder_backup_init_logs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/cinder:/var/log/cinder:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R cinder:cinder /var/log/cinder\"]}}, \"step_4\": {\"cinder_backup\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"ipc\": \"host\", \"net\": \"host\", \"privileged\": true, \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"get_attr\": [\"CinderCommon\", \"cinder_backup_volumes\"]}, \"environment\": {\"get_attr\": [\"CinderCommon\", \"cinder_backup_environment\"]}}}}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"CinderCommon\", \"cinder_backup_host_prep_tasks\"]}, [{\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]]}, \"deploy_steps_tasks\": [{\"name\": \"Clean up when switching cinder-backup from pcmk to active-active\", \"when\": [\"step|int == 1\"], \"become\": true, \"block\": [{\"name\": \"Check if cinder-backup is running under pacemaker\", \"command\": \"pcs status\", \"register\": \"cinder_backup_pcs_status\", \"check_mode\": false, \"failed_when\": false, \"changed_when\": false}, {\"when\": [\"\\\"cinder-backup\\\" in cinder_backup_pcs_status.stdout\"], \"block\": [{\"name\": \"Remove the openstack-cinder-backup pcs resource\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-backup\", \"state\": \"delete\"}, \"run_once\": true}, {\"name\": \"Identify the cinder-backup pcmklatest container image\", \"shell\": \"{{container_cli}} images | awk '$1 ~ \\\"cinder-backup\\\" && $2 == \\\"pcmklatest\\\" {print $1\\\":\\\"$2}'\", \"register\": \"cinder_backup_pcmklatest_image\", \"check_mode\": false, \"changed_when\": false}, {\"name\": \"Remove the cinder-backup pcmklatest container image\", \"command\": \"{{container_cli}} rmi {{cinder_backup_pcmklatest_image.stdout}}\", \"when\": [\"cinder_backup_pcmklatest_image.stdout|length > 0\"]}]}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop cinder backup container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"cinder_backup\"], \"tripleo_delegate_to\": \"{{ groups['cinder_backup'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backup-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Cinder Backup service\\n\", \"parameters\": {\"ContainerCinderBackupImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCinderConfigImage\": {\"description\": \"The container image to use for the cinder config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"CinderBackupBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Cinder Backup backend to use.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"ceph\", \"nfs\", \"gcs\", \"s3\"]}]}, \"CinderBackupRbdPoolName\": {\"default\": \"backups\", \"type\": \"string\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"DockerCinderBackupLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.cinder.backup\", \"file\": \"/var/log/containers/cinder/cinder-backup.log\"}}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"CinderBackupBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-backup-container-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"CinderBackupBackend\": {\"get_param\": \"CinderBackupBackend\"}, \"CinderBackupRbdPoolName\": {\"get_param\": \"CinderBackupRbdPoolName\"}, \"CephClientUserName\": {\"get_param\": \"CephClientUserName\"}}}, \"CinderCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cinder/cinder-common-container-puppet.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCinderBackupImage\": \"ContainerCinderBackupImage\", \"ContainerCinderConfigImage\": \"ContainerCinderConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCinderBackupImage\": {\"get_param\": \"ContainerCinderBackupImage\"}, \"ContainerCinderConfigImage\": {\"get_param\": \"ContainerCinderConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Cinder Backup role.\", \"value\": {\"service_name\": \"cinder_backup\", \"monitoring_subscription\": {\"get_attr\": [\"CinderBackupBase\", \"role_data\", \"monitoring_subscription\"]}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CinderBackupBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::profile::pacemaker::cinder::backup_bundle::cinder_backup_docker_image\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-backup:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"tripleo::profile::pacemaker::cinder::backup_bundle::docker_volumes\": {\"get_attr\": [\"CinderCommon\", \"cinder_backup_volumes\"]}, \"tripleo::profile::pacemaker::cinder::backup_bundle::docker_environment\": {\"get_attr\": [\"CinderCommon\", \"cinder_backup_environment\"]}, \"tripleo::profile::pacemaker::cinder::backup_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::cinder::backup_bundle::ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"cinder::backup::manage_service\": false, \"cinder::backup::enabled\": false}]}, \"service_config_settings\": {\"get_attr\": [\"CinderBackupBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"cinder\", \"puppet_tags\": \"cinder_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [{\"get_attr\": [\"CinderBackupBase\", \"role_data\", \"puppet_config\", \"step_config\"]}, \"include tripleo::profile::pacemaker::cinder::backup_bundle\"]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/cinder_backup.json\": {\"command\": \"/usr/bin/cinder-backup --config-file /usr/share/cinder/cinder-dist.conf --config-file /etc/cinder/cinder.conf\", \"config_files\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_config_files\"]}, \"permissions\": {\"get_attr\": [\"CinderCommon\", \"cinder_common_kolla_permissions\"]}}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_3\": {\"cinder_backup_init_logs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/cinder:/var/log/cinder:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R cinder:cinder /var/log/cinder\"]}}}, \"host_prep_tasks\": {\"get_attr\": [\"CinderCommon\", \"cinder_backup_host_prep_tasks\"]}, \"deploy_steps_tasks\": [{\"name\": \"Cinder Backup tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"container_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-backup:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"Cinder Backup HA Wrappers Step\", \"when\": \"step|int == 5\", \"block\": [{\"name\": \"Cinder backup puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"cinder_backup\", \"tripleo_ha_wrapper_resource_name\": \"openstack-cinder-backup\", \"tripleo_ha_wrapper_bundle_name\": \"openstack-cinder-backup\", \"tripleo_ha_wrapper_resource_state\": \"_ Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"cinder\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::backup_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".cinder_backup_previous_run\"}}]}], \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get cinder_backup image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_cinder_backup_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container cinder_backup image\", \"set_fact\": {\"cinder_backup_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"cinder_backup_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-backup:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_cinder_backup_image\": \"{{xmllint_pcmk_cinder_backup_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"cinder_backup\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"cinder-backup temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"cinder_backup\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"openstack-cinder-backup\", \"tripleo_ha_image_update_new_image\": \"{{cinder_backup_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_cinder_backup_image}}\"}, \"when\": [\"(pcmk_cinder_backup_image != \\\"\\\")\", \"(pcmk_cinder_backup_image != cinder_backup_image_latest)\"]}]}], \"update_tasks\": [{\"block\": [{\"name\": \"Get cinder_backup image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_cinder_backup_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container cinder_backup image\", \"set_fact\": {\"cinder_backup_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"cinder_backup_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-backup:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_cinder_backup_image\": \"{{xmllint_pcmk_cinder_backup_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of cinder-backup container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_cinder_backup_image == cinder_backup_image_latest\", \"fail_msg\": \"cinder-backup image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"Tear-down non-HA cinder-backup container\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Remove non-HA cinder-backup container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"cinder_backup\"]}}]}, {\"name\": \"cinder_backup fetch and retag container image for pacemaker\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Retag pcmklatest to latest cinder_backup image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{cinder_backup_image}}\", \"container_image_latest\": \"{{cinder_backup_image_latest}}\"}}]}], \"post_update_tasks\": [{\"name\": \"Cinder backup bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Cinder backup puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"cinder_backup\", \"tripleo_ha_wrapper_resource_name\": \"openstack-cinder-backup\", \"tripleo_ha_wrapper_bundle_name\": \"openstack-cinder-backup\", \"tripleo_ha_wrapper_resource_state\": \"_ Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"cinder\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::cinder::backup_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".cinder_backup_previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}], \"upgrade_tasks\": [{\"name\": \"Tear-down non-HA cinder_backup container\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Remove non-HA cinder-backup container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"cinder_backup\"]}}]}, {\"name\": \"Prepare switch of cinder_backup image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get cinder_backup image id currently used by pacemaker\", \"shell\": \"pcs resource config openstack-cinder-backup | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"cinder_backup_image_current_res\", \"failed_when\": false}, {\"name\": \"cinder_backup image facts\", \"set_fact\": {\"cinder_backup_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-backup:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"cinder_backup_image_current\": \"{{cinder_backup_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current cinder_backup image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{cinder_backup_image_current}}\", \"container_image_latest\": \"{{cinder_backup_image_latest}}\", \"pull_image\": false}, \"when\": [\"cinder_backup_image_current != ''\", \"cinder_backup_image_current != cinder_backup_image_latest\"]}, {\"name\": \"Create cinder_backup retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/cinder_backup_needs_retag\", \"state\": \"touch\"}, \"when\": [\"cinder_backup_image_current != ''\", \"cinder_backup_image_current != cinder_backup_image_latest\"]}]}, {\"name\": \"Update cinder_backup pcs resource bundle for new container image - check\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"set is_cinder_backup_bootstrap_node fact\", \"tags\": \"common\", \"set_fact\": \"is_cinder_backup_bootstrap_node={{cinder_backup_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}, {\"name\": \"Check for cinder_backup retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/cinder_backup_needs_retag\"}, \"register\": \"cinder_backup_retag_state_file\"}]}, {\"name\": \"Update cinder_backup pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_cinder_backup_bootstrap_node\", \"cinder_backup_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the cinder_backup cluster resource before container upgrade step1\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-backup\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Update the cinder_backup bundle to use the new container image name\", \"command\": \"pcs resource bundle update openstack-cinder-backup container image={{cinder_backup_image_latest}}\"}, {\"name\": \"Enable the cinder_backup cluster resource\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-backup\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}, {\"name\": \"Check for cinder_backup retag statefile\", \"when\": [\"step|int == 3\"], \"stat\": {\"path\": \"/var/lib/tripleo/cinder_backup_needs_retag\"}, \"register\": \"cinder_backup_retag_state_file\"}, {\"name\": \"Retag the pacemaker image for cinder_backup\", \"when\": [\"step|int == 3\", \"cinder_backup_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the cinder_backup cluster resource before container upgrade step3\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-backup\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Retag the pacemaker image if containerized\", \"block\": [{\"block\": [{\"name\": \"Get cinder_backup image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_cinder_backup_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-cinder-backup']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container cinder_backup image\", \"set_fact\": {\"cinder_backup_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"cinder_backup_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/cinder-backup:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCinderBackupImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_cinder_backup_image\": \"{{xmllint_pcmk_cinder_backup_image.stdout}}\"}}]}, {\"block\": [{\"name\": \"Retag pcmklatest to latest cinder_backup image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{cinder_backup_image}}\", \"container_image_latest\": \"{{cinder_backup_image_latest}}\"}}]}]}, {\"name\": \"Enable the cinder_backup cluster resource\", \"pacemaker_resource\": {\"resource\": \"openstack-cinder-backup\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Remove cinder_backup retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/cinder_backup_needs_retag\", \"state\": \"absent\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/barbican/barbican-client-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Barbican client configuration\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Barbican client.\", \"value\": {\"service_name\": \"barbican_client\", \"service_config_settings\": {\"nova_compute\": {\"nova::compute::keymgr_backend\": \"barbican\", \"nova::compute::barbican_endpoint\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"nova::compute::barbican_auth_endpoint\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}}, \"cinder_api\": {\"cinder::keymgr_backend\": \"barbican\", \"cinder::keymgr_encryption_api_url\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"cinder::keymgr_encryption_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}}, \"cinder_volume\": {\"cinder::keymgr_backend\": \"barbican\", \"cinder::keymgr_encryption_api_url\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"cinder::keymgr_encryption_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}}, \"cinder_backup\": {\"cinder::keymgr_backend\": \"barbican\", \"cinder::keymgr_encryption_api_url\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"cinder::keymgr_encryption_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}}, \"glance_api\": {\"glance::api::keymgr_backend\": \"barbican\", \"glance::api::keymgr_encryption_api_url\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"glance::api::keymgr_encryption_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}}, \"glance_api_edge\": {\"glance::api::keymgr_backend\": \"barbican\", \"glance::api::keymgr_encryption_api_url\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"glance::api::keymgr_encryption_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/barbican/barbican-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Barbican API service\\n\", \"parameters\": {\"ContainerBarbicanApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerBarbicanConfigImage\": {\"description\": \"The container image to use for the barbican config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerBarbicanKeystoneListenerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerBarbicanWorkerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"BarbicanPkcs11CryptoATOSEnabled\": {\"type\": \"boolean\", \"default\": false}, \"BarbicanPkcs11CryptoLunasaEnabled\": {\"type\": \"boolean\", \"default\": false}, \"BarbicanPkcs11CryptoThalesEnabled\": {\"type\": \"boolean\", \"default\": false}, \"BarbicanPkcs11CryptoEnabled\": {\"type\": \"boolean\", \"default\": false}, \"BarbicanPkcs11CryptoLibraryPath\": {\"description\": \"Path to vendor PKCS11 library\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPkcs11CryptoLogin\": {\"description\": \"Password (PIN) to login to PKCS#11 session\", \"type\": \"string\", \"hidden\": true, \"default\": \"\"}, \"BarbicanPkcs11CryptoMKEKLabel\": {\"description\": \"Label for Master KEK\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPkcs11CryptoHMACLabel\": {\"description\": \"Label for the HMAC key\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPkcs11CryptoSlotId\": {\"description\": \"Slot Id for the PKCS#11 token to be used\", \"type\": \"string\", \"default\": \"0\"}, \"BarbicanPkcs11CryptoTokenSerialNumber\": {\"description\": \"Serial number for PKCS#11 token to be used\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPkcs11CryptoTokenLabel\": {\"description\": \"(DEPRECATED) Use BarbicanPkcs11CryptoTokenLabels instead.\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPkcs11CryptoTokenLabels\": {\"description\": \"List of comma separated labels for the tokens to be used. This is typically a single label, but some devices may require more than one label for Load Balancing and High Availability configurations.\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPkcs11CryptoHMACKeyType\": {\"description\": \"Cryptoki Key Type for Master HMAC key\", \"type\": \"string\", \"default\": \"CKK_AES\"}, \"BarbicanPkcs11CryptoHMACKeygenMechanism\": {\"description\": \"Cryptoki Mechanism used to generate Master HMAC Key\", \"type\": \"string\", \"default\": \"CKM_AES_KEY_GEN\"}, \"BarbicanPkcs11CryptoRewrapKeys\": {\"description\": \"Cryptoki Mechanism used to generate Master HMAC Key\", \"type\": \"boolean\", \"default\": false}, \"ThalesHSMNetworkName\": {\"description\": \"The network that the HSM is listening on.\", \"type\": \"string\", \"default\": \"internal_api\"}, \"ThalesVars\": {\"default\": {}, \"description\": \"Hash of thales_hsm role variables used to install Thales client software.\", \"type\": \"json\"}, \"ATOSVars\": {\"default\": {}, \"description\": \"Hash of atos-hsm role variables used to install ATOS client software.\", \"type\": \"json\"}, \"LunasaVars\": {\"default\": {}, \"description\": \"Hash of lunasa-hsm role variables used to install Lunasa client software.\", \"type\": \"json\"}, \"LunasaClientIPNetwork\": {\"description\": \"(Optional) When set Barbican nodes will be registered with the HSMs using the IP from this network instead of the FQDN.\\n\", \"type\": \"string\", \"default\": \"\"}, \"BarbicanPassword\": {\"description\": \"The password for the barbican service account.\", \"type\": \"string\", \"hidden\": true}, \"BarbicanWorkers\": {\"description\": \"Set the number of workers for barbican::wsgi::apache\", \"default\": \"%{::processorcount}\", \"type\": \"string\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"BarbicanDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Barbican service.\", \"type\": \"boolean\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"BarbicanPolicies\": {\"description\": \"A hash of policies to configure for Barbican.\\ne.g. { barbican-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}}, \"conditions\": {\"hsm_enabled\": {\"or\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, {\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, {\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}]}, \"pkcs11_plugin_enabled\": {\"equals\": [{\"get_param\": \"BarbicanPkcs11CryptoEnabled\"}, true]}, \"pkcs11_rewrap_pkeks\": {\"equals\": [{\"get_param\": \"BarbicanPkcs11CryptoRewrapKeys\"}, true]}, \"pkcs11_tokens_unset\": {\"equals\": [{\"get_param\": \"BarbicanPkcs11CryptoTokenLabels\"}, \"\"]}, \"enable_sqlalchemy_collectd\": {\"equals\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, true]}, \"lunasa_hsm_use_fqdn\": {\"equals\": [{\"get_param\": \"LunasaClientIPNetwork\"}, \"\"]}}, \"resources\": {\"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"BarbicanApiLogging\": {\"type\": \"OS::TripleO::Services::Logging::BarbicanApi\"}, \"BarbicanClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/barbican/barbican-client-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerBarbicanApiImage\": \"ContainerBarbicanApiImage\", \"ContainerBarbicanConfigImage\": \"ContainerBarbicanConfigImage\", \"ContainerBarbicanKeystoneListenerImage\": \"ContainerBarbicanKeystoneListenerImage\", \"ContainerBarbicanWorkerImage\": \"ContainerBarbicanWorkerImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerBarbicanApiImage\": {\"get_param\": \"ContainerBarbicanApiImage\"}, \"ContainerBarbicanConfigImage\": {\"get_param\": \"ContainerBarbicanConfigImage\"}, \"ContainerBarbicanKeystoneListenerImage\": {\"get_param\": \"ContainerBarbicanKeystoneListenerImage\"}, \"ContainerBarbicanWorkerImage\": {\"get_param\": \"ContainerBarbicanWorkerImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Barbican API role.\", \"value\": {\"service_name\": \"barbican_api\", \"firewall_rules\": {\"117 barbican\": {\"dport\": [9311]}}, \"firewall_frontend_rules\": {\"100 barbican_haproxy_frontend\": {\"dport\": [9311]}}, \"firewall_ssl_frontend_rules\": {\"100 barbican_haproxy_frontend_ssl\": {\"dport\": [13311]}}, \"keystone_resources\": {\"barbican\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"BarbicanInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"BarbicanAdmin\", \"uri\"]}}, \"users\": {\"barbican\": {\"password\": {\"get_param\": \"BarbicanPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"key-manager\", \"roles\": [\"key-manager:service-admin\", \"creator\", \"observer\", \"audit\"]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"config_settings\"]}, {\"apache::default_vhost\": false, \"barbican::keystone::authtoken::password\": {\"get_param\": \"BarbicanPassword\"}, \"barbican::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"barbican::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"barbican::keystone::authtoken::project_name\": \"service\", \"barbican::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"barbican::keystone::authtoken::interface\": \"internal\", \"barbican::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"barbican::keystone::notification::enable_keystone_notification\": true, \"barbican::keystone::notification::keystone_notification_topic\": \"barbican_notifications\", \"barbican::policy::policies\": {\"get_param\": \"BarbicanPolicies\"}, \"barbican::api::host_href\": {\"get_param\": [\"EndpointMap\", \"BarbicanPublic\", \"uri\"]}, \"barbican::api::db_auto_create\": false, \"barbican::api::enabled_certificate_plugins\": [\"simple_certificate\"], \"barbican::api::enable_queue\": true, \"barbican::api::logging::debug\": {\"if\": [{\"get_param\": \"BarbicanDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"barbican::api::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"barbican::api::rabbit_heartbeat_in_pthread\": false, \"barbican::api::service_name\": \"httpd\", \"barbican::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}}}, \"barbican::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"barbican::wsgi::apache::workers\": {\"get_param\": \"BarbicanWorkers\"}, \"barbican::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"BarbicanApiNetwork\"]}}}}, \"barbican::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"barbican\", \"password\": {\"get_param\": \"BarbicanPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/barbican\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"barbican\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}}]}, \"service_config_settings\": {\"map_merge\": [{\"get_attr\": [\"BarbicanClient\", \"role_data\", \"service_config_settings\"]}, {\"mysql\": {\"barbican::db::mysql::password\": {\"get_param\": \"BarbicanPassword\"}, \"barbican::db::mysql::user\": \"barbican\", \"barbican::db::mysql::host\": \"%\", \"barbican::db::mysql::dbname\": \"barbican\"}, \"keystone\": {\"tripleo::profile::base::keystone::barbican_notification_topics\": [\"barbican_notifications\"]}}]}, \"puppet_config\": {\"config_volume\": \"barbican\", \"puppet_tags\": \"barbican_api_paste_ini,barbican_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::barbican::api\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/barbican_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_keystone_listener.json\": {\"command\": \"/usr/bin/barbican-keystone-listener\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_worker.json\": {\"command\": \"/usr/bin/barbican-worker\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_db_sync.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage\", {\"get_attr\": [\"BarbicanApiLogging\", \"cmd_extra_args\"]}, \"db upgrade\", \"'\"]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_create_mkek.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage\", {\"get_attr\": [\"BarbicanApiLogging\", \"cmd_extra_args\"]}, \"hsm check_mkek --label\", {\"get_param\": [\"BarbicanPkcs11CryptoMKEKLabel\"]}, \"|| /usr/bin/barbican-manage\", {\"get_attr\": [\"BarbicanApiLogging\", \"cmd_extra_args\"]}, \"hsm gen_mkek --label\", {\"get_param\": [\"BarbicanPkcs11CryptoMKEKLabel\"]}, \"'\"]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_create_hmac.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage\", {\"get_attr\": [\"BarbicanApiLogging\", \"cmd_extra_args\"]}, \"hsm check_hmac --label\", {\"get_param\": [\"BarbicanPkcs11CryptoHMACLabel\"]}, \"|| /usr/bin/barbican-manage hsm gen_hmac --label\", {\"get_param\": [\"BarbicanPkcs11CryptoHMACLabel\"]}, \"'\"]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_update_rfs_server.json\": {\"command\": \"/usr/bin/bootstrap_host_exec barbican_api /opt/nfast/bin/rfs-sync --commit\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_get_from_rfs.json\": {\"command\": \"/opt/nfast/bin/rfs-sync --update\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_secret_store_sync.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage\", {\"get_attr\": [\"BarbicanApiLogging\", \"cmd_extra_args\"]}, \"db sync_secret_stores --verbose\", \"'\"]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/barbican_api_rewrap_pkeks.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage\", {\"get_attr\": [\"BarbicanApiLogging\", \"cmd_extra_args\"]}, \"hsm rewrap_pkek\", \"'\"]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"external_deploy_tasks\": {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [{\"name\": \"Add ip addresses to the RFS server\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"get the ip addresses for the barbican nodes\", \"set_fact\": {\"thales_rfs_playbook_dir\": \"/tmp/thales_rfs_role_working_dir\", \"thales_client_ips\": {\"str_replace\": {\"template\": \"{% for host in groups['barbican_backend_pkcs11_crypto'] -%}\\n  {{ hostvars[host]['$THALES_HSM_NETWORK_NAME_ip'] + ' ' }}\\n{%- endfor %}\", \"params\": {\"$THALES_HSM_NETWORK_NAME\": {\"get_param\": \"ThalesHSMNetworkName\"}}}}, \"thales_bootstrap_client_ip\": {\"str_replace\": {\"template\": \"{% for host in groups['barbican_backend_pkcs11_crypto'] -%} {% if hostvars[host]['bootstrap_server_id'] == hostvars[host]['deploy_server_id'] -%} {{ hostvars[host]['$THALES_HSM_NETWORK_NAME_ip'] }} {%- endif %} {%- endfor %}\", \"params\": {\"$THALES_HSM_NETWORK_NAME\": {\"get_param\": \"ThalesHSMNetworkName\"}}}}, \"thales_rfs_user\": {\"get_param\": [\"ThalesVars\", \"thales_rfs_user\"]}, \"nshield_hsms\": {\"get_param\": [\"ThalesVars\", \"nshield_hsms\"]}}}, {\"name\": \"allow using legacy variables for backwards compatibility\", \"set_fact\": {\"nshield_hsms\": [{\"name\": \"Legacy variables HSM\", \"ip\": {\"get_param\": [\"ThalesVars\", \"thales_hsm_ip_address\"]}}]}, \"when\": \"nshield_hsms|length == 0\"}, {\"name\": \"set playbook vars\", \"set_fact\": {\"thales_rfs_inventory\": \"{{thales_rfs_playbook_dir}}/inventory\", \"thales_rfs_keyfile\": \"{{thales_rfs_playbook_dir}}/rfs_rsa\", \"thales_rfs_playbook\": \"{{thales_rfs_playbook_dir}}/rfs.yaml\"}}, {\"name\": \"creating working directory\", \"file\": {\"path\": \"{{thales_rfs_playbook_dir}}\", \"state\": \"directory\"}}, {\"name\": \"generate an inventory\", \"copy\": {\"dest\": \"{{thales_rfs_inventory}}\", \"content\": {\"get_param\": [\"ThalesVars\", \"thales_rfs_server_ip_address\"]}}}, {\"name\": \"write SSH key to file\", \"copy\": {\"dest\": \"{{thales_rfs_keyfile}}\", \"content\": {\"get_param\": [\"ThalesVars\", \"thales_rfs_key\"]}, \"mode\": 256}}, {\"name\": \"generate playbook to run\", \"copy\": {\"dest\": \"{{thales_rfs_playbook}}\", \"content\": \"---\\n- hosts: all\\n  remote_user: \\\"{{thales_rfs_user}}\\\"\\n  vars:\\n    thales_configure_rfs: true\\n    thales_client_ips: \\\"{{thales_client_ips}}\\\"\\n    thales_bootstrap_client_ip: \\\"{{thales_bootstrap_client_ip}}\\\"\\n    nshield_hsms: \\\"{{nshield_hsms}}\\\"\\n  roles:\\n    - thales_hsm\\n\"}}, {\"name\": \"call ansible on rfs server\", \"shell\": \"ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -i \\\"{{thales_rfs_inventory}}\\\" --key-file \\\"{{thales_rfs_keyfile}}\\\" --ssh-extra-args \\\"-o StrictHostKeyChecking=no\\\" \\\"{{thales_rfs_playbook}}\\\"\"}, {\"name\": \"clean up working directory\", \"file\": {\"path\": \"{{thales_rfs_playbook_dir}}\", \"state\": \"absent\"}}]}]]}, \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, {\"if\": [\"hsm_enabled\", {\"list_concat\": [{\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [{\"name\": \"Thales client install\", \"when\": \"step|int == 2\", \"block\": [{\"set_fact\": {\"my_thales_client_ip\": {\"str_replace\": {\"template\": \"{{$NETWORK_ip}}\", \"params\": {\"$NETWORK\": {\"get_param\": \"ThalesHSMNetworkName\"}}}}}}, {\"include_role\": {\"name\": \"thales_hsm\"}, \"vars\": {\"map_merge\": [{\"thales_install_client\": true}, {\"get_param\": \"ThalesVars\"}]}}]}]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [{\"name\": \"ATOS client install\", \"when\": \"step|int == 2\", \"block\": [{\"include_role\": {\"name\": \"atos_hsm\"}, \"vars\": {\"get_param\": \"ATOSVars\"}}]}]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [{\"name\": \"Lunasa client install\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"install the lunasa client\", \"include_role\": {\"name\": \"lunasa_hsm\"}, \"vars\": {\"if\": [\"lunasa_hsm_use_fqdn\", {\"map_merge\": [{\"get_param\": \"LunasaVars\"}, {\"lunasa_client_pin\": {\"get_param\": \"BarbicanPkcs11CryptoLogin\"}}, {\"if\": [\"pkcs11_tokens_unset\", {\"lunasa_ha_label\": {\"get_param\": \"BarbicanPkcs11CryptoTokenLabel\"}}, {\"lunasa_ha_label\": {\"get_param\": \"BarbicanPkcs11CryptoTokenLabels\"}}]}]}, {\"map_merge\": [{\"get_param\": \"LunasaVars\"}, {\"lunasa_client_pin\": {\"get_param\": \"BarbicanPkcs11CryptoLogin\"}}, {\"if\": [\"pkcs11_tokens_unset\", {\"lunasa_ha_label\": {\"get_param\": \"BarbicanPkcs11CryptoTokenLabel\"}}, {\"lunasa_ha_label\": {\"get_param\": \"BarbicanPkcs11CryptoTokenLabels\"}}]}, {\"lunasa_client_ip\": {\"str_replace\": {\"template\": \"{{$NETWORK_ip}}\", \"params\": {\"$NETWORK\": {\"get_param\": \"LunasaClientIPNetwork\"}}}}}]}]}}]}]]}]}]}]}, \"docker_config\": {\"step_2\": {\"map_merge\": [{\"get_attr\": [\"BarbicanApiLogging\", \"docker_config\", \"step_2\"]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, {\"barbican_init_atos_directory\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"volumes\": [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R barbican:barbican /etc/proteccio && chown barbican:barbican /usr/lib64/libnethsm.so\"]}}, {}]}]}, \"step_3\": {\"map_merge\": [{\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoEnabled\"}, {\"barbican_api_create_mkek\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_create_mkek.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoEnabled\"}, {\"barbican_api_create_hmac\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_create_hmac.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, {}]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, {\"barbican_api_update_rfs_server_with_mkek_and_hmac_keys\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_update_rfs_server.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, {\"barbican_api_get_mkek_and_hmac_keys_from_rfs\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_get_from_rfs.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}]}, {\"barbican_api_db_sync\": {\"start_order\": 3, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"barbican_api_secret_store_sync\": {\"start_order\": 4, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_secret_store_sync.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoRewrapKeys\"}, {\"barbican_api_rewrap_pkeks\": {\"start_order\": 4, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, [\"/var/lib/kolla/config_files/barbican_api_rewrap_pkeks.json:/var/lib/kolla/config_files/config.json:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}]}, {\"barbican_api\": {\"start_order\": 5, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanApiImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"user\": \"root\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/barbican_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"barbican_keystone_listener\": {\"start_order\": 6, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanKeystoneListenerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"user\": \"barbican\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/barbican_keystone_listener.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"barbican_worker\": {\"start_order\": 7, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerBarbicanWorkerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"user\": \"barbican\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"BarbicanApiLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/barbican_worker.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/barbican:/var/lib/kolla/config_files/src:ro\"], {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoThalesEnabled\"}, [\"/lib64/libnsl.so.1:/lib64/libnsl.so.1\", \"/opt/nfast:/opt/nfast\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoATOSEnabled\"}, [\"/etc/proteccio:/etc/proteccio\", \"/usr/lib64/libnethsm.so:/usr/lib64/libnethsm.so\"]]}, {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [\"/etc/Chrystoki.conf:/etc/Chrystoki.conf\", \"/usr/lib/libCryptoki2_64.so:/usr/lib/libCryptoki2_64.so\", \"/usr/safenet/lunaclient:/usr/safenet/lunaclient\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"BarbicanApiLogging\", \"host_prep_tasks\"]}, [{\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]]}, \"scale_tasks\": {\"if\": [{\"get_param\": \"BarbicanPkcs11CryptoLunasaEnabled\"}, [{\"name\": \"Remove HSM clients\", \"when\": \"step|int == 1\", \"tags\": \"down\", \"block\": [{\"name\": \"Remove client from HSM\", \"import_role\": {\"name\": \"lunasa_hsm\", \"tasks_from\": \"unregister_client\"}, \"delegate_to\": \"{{ groups['Undercloud'] | first }}\", \"vars\": [{\"map_merge\": [{\"get_param\": \"LunasaVars\"}, {\"lunasa_client_pin\": {\"get_param\": \"BarbicanPkcs11CryptoLogin\"}}, {\"client_name\": \"{{ fqdn_canonical }}\"}]}]}]}]]}, \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop barbican api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"barbican_api\"], \"tripleo_delegate_to\": \"{{ groups['barbican_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/barbican/barbican-backend-simple-crypto-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Barbican API simple crypto backend configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"BarbicanSimpleCryptoKek\": {\"description\": \"KEK used to encrypt secrets\", \"type\": \"string\", \"hidden\": true}, \"BarbicanSimpleCryptoGlobalDefault\": {\"description\": \"Whether this plugin is the global default plugin\", \"type\": \"boolean\", \"default\": false}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Barbican simple crypto backend.\", \"value\": {\"service_name\": \"barbican_backend_simple_crypto\", \"config_settings\": {\"barbican::plugins::simple_crypto::simple_crypto_plugin_kek\": {\"get_param\": \"BarbicanSimpleCryptoKek\"}, \"barbican::plugins::simple_crypto::global_default\": {\"get_param\": \"BarbicanSimpleCryptoGlobalDefault\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Openstack Manila base service. Shared by manila-api/scheduler/share services\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ManilaIPv6\": {\"default\": false, \"description\": \"Set to True to enable IPv6 access in manila.\", \"type\": \"boolean\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"ManilaDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Manila services.\", \"type\": \"boolean\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"ManilaPassword\": {\"description\": \"The password for the manila service account.\", \"type\": \"string\", \"hidden\": true}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"ManilaStorageAvailabilityZone\": {\"default\": \"nova\", \"description\": \"The Manila service's storage availability zone.\", \"type\": \"string\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Manila Base service.\", \"value\": {\"service_name\": \"manila_base\", \"config_settings\": {\"manila::storage_availability_zone\": {\"get_param\": \"ManilaStorageAvailabilityZone\"}, \"manila::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"manila::logging::debug\": {\"if\": [{\"get_param\": \"ManilaDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"manila::db::database_db_max_retries\": -1, \"manila::db::database_max_retries\": -1, \"manila::sql_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"manila\", \"password\": {\"get_param\": \"ManilaPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/manila\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"manila\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"manila::network::neutron::network_plugin_ipv6_enabled\": {\"get_param\": \"ManilaIPv6\"}, \"manila::network::neutron::network_plugin_ipv4_enabled\": {\"if\": [{\"get_param\": \"ManilaIPv6\"}, false, true]}, \"manila::rabbit_heartbeat_in_pthread\": false}, \"service_config_settings\": {\"mysql\": {\"manila::db::mysql::password\": {\"get_param\": \"ManilaPassword\"}, \"manila::db::mysql::user\": \"manila\", \"manila::db::mysql::host\": \"%\", \"manila::db::mysql::dbname\": \"manila\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Manila API service\\n\", \"parameters\": {\"ContainerManilaApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerManilaConfigImage\": {\"description\": \"The container image to use for the manila config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"ManilaWorkers\": {\"type\": \"string\", \"description\": \"Set the number of workers for manila::wsgi::apache\", \"default\": \"%{::os_workers}\"}, \"ManilaPassword\": {\"description\": \"The password for the manila service account.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"ManilaApiPolicies\": {\"description\": \"A hash of policies to configure for Manila API.\\ne.g. { manila-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"MonitoringSubscriptionManilaApi\": {\"default\": \"overcloud-manila-api\", \"type\": \"string\"}, \"ManilaEnabledShareProtocols\": {\"default\": \"\", \"description\": \"List of protocols to be allowed for share creation in manila. When not set, the list is inferred via the storage back end/s enabled.\", \"type\": \"comma_delimited_list\"}, \"ManilaCronDbPurgeMinute\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Minute\\n\", \"default\": \"1\"}, \"ManilaCronDbPurgeHour\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Hour\\n\", \"default\": \"0\"}, \"ManilaCronDbPurgeMonthday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month Day\\n\", \"default\": \"*\"}, \"ManilaCronDbPurgeMonth\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Month\\n\", \"default\": \"*\"}, \"ManilaCronDbPurgeWeekday\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Week Day\\n\", \"default\": \"*\"}, \"ManilaCronDbPurgeUser\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - User\\n\", \"default\": \"manila\"}, \"ManilaCronDbPurgeAge\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Age\\n\", \"default\": \"30\"}, \"ManilaCronDbPurgeDestination\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Log destination\\n\", \"default\": \"/var/log/manila/manila-rowsflush.log\"}, \"ManilaCronDbPurgeMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to purge db entries marked as deleted and older than $age - Max Delay\\n\", \"default\": \"3600\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"ManilaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/manila/manila-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerManilaApiImage\": \"ContainerManilaApiImage\", \"ContainerManilaConfigImage\": \"ContainerManilaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerManilaApiImage\": {\"get_param\": \"ContainerManilaApiImage\"}, \"ContainerManilaConfigImage\": {\"get_param\": \"ContainerManilaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Manila API role.\", \"value\": {\"service_name\": \"manila_api\", \"firewall_rules\": {\"150 manila\": {\"dport\": [8786]}}, \"firewall_frontend_rules\": {\"100 manila_haproxy_frontend\": {\"dport\": [8786]}}, \"firewall_ssl_frontend_rules\": {\"100 manila_haproxy_frontend_ssl\": {\"dport\": [13786]}}, \"keystone_resources\": {\"manila\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"ManilaV1Public\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"ManilaV1Internal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"ManilaV1Admin\", \"uri\"]}}, \"users\": {\"manila\": {\"password\": {\"get_param\": \"ManilaPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"share\"}, \"manilav2\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"ManilaPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"ManilaInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"ManilaAdmin\", \"uri\"]}}, \"users\": {\"manilav2\": {\"password\": {\"get_param\": \"ManilaPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"sharev2\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionManilaApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"ManilaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"manila::keystone::authtoken::password\": {\"get_param\": \"ManilaPassword\"}, \"manila::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"manila::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"manila::keystone::authtoken::project_name\": \"service\", \"manila::keystone::authtoken::user_domain_name\": \"Default\", \"manila::keystone::authtoken::project_domain_name\": \"Default\", \"manila::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"manila::keystone::authtoken::interface\": \"internal\", \"manila::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"manila::api::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}}}, \"manila::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}}}, \"manila::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"manila::api::service_name\": \"httpd\", \"manila::api::enable_proxy_headers_parsing\": true, \"manila::api::default_share_type\": \"default\", \"manila_enabled_share_protocols\": {\"get_param\": \"ManilaEnabledShareProtocols\"}, \"manila::policy::policies\": {\"get_param\": \"ManilaApiPolicies\"}, \"manila::cron::db_purge::minute\": {\"get_param\": \"ManilaCronDbPurgeMinute\"}, \"manila::cron::db_purge::hour\": {\"get_param\": \"ManilaCronDbPurgeHour\"}, \"manila::cron::db_purge::monthday\": {\"get_param\": \"ManilaCronDbPurgeMonthday\"}, \"manila::cron::db_purge::month\": {\"get_param\": \"ManilaCronDbPurgeMonth\"}, \"manila::cron::db_purge::weekday\": {\"get_param\": \"ManilaCronDbPurgeWeekday\"}, \"manila::cron::db_purge::user\": {\"get_param\": \"ManilaCronDbPurgeUser\"}, \"manila::cron::db_purge::age\": {\"get_param\": \"ManilaCronDbPurgeAge\"}, \"manila::cron::db_purge::destination\": {\"get_param\": \"ManilaCronDbPurgeDestination\"}, \"manila::cron::db_purge::maxdelay\": {\"get_param\": \"ManilaCronDbPurgeMaxDelay\"}, \"manila::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"ManilaApiNetwork\"]}}}}, \"manila::wsgi::apache::workers\": {\"get_param\": \"ManilaWorkers\"}}]}, \"service_config_settings\": {\"get_attr\": [\"ManilaBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"manila\", \"puppet_tags\": \"manila_config,manila_api_paste_ini\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::manila::api\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/manila_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/manila\", \"owner\": \"manila:manila\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/manila_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec manila_api su manila -s /bin/bash -c '/usr/bin/manila-manage db sync'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/manila\", \"owner\": \"manila:manila\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/manila_api_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/manila\", \"owner\": \"manila:manila\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"manila_init_logs\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaApiImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [\"/var/log/containers/manila:/var/log/manila:z\", \"/var/log/containers/httpd/manila-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R manila:manila /var/log/manila\"]}}, \"step_3\": {\"manila_api_db_sync\": {\"user\": \"root\", \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"detach\": false, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/manila_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/manila:/var/log/manila:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, \"step_4\": {\"manila_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaApiImage\"]}, \"net\": \"host\", \"restart\": \"always\", \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/manila_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/manila:/var/log/manila:z\", \"/var/log/containers/httpd/manila-api:/var/log/httpd:z\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"manila_api_cron\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron manila\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/manila_api_cron.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/manila:/var/log/manila:z\", \"/var/log/containers/httpd/manila-api:/var/log/httpd:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"host_prep_tasks\": [{\"name\": \"Create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/manila\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/manila-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop manila api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"manila_api\"], \"tripleo_delegate_to\": \"{{ groups['manila_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-scheduler-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Manila Scheduler service\\n\", \"parameters\": {\"ContainerManilaSchedulerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerManilaConfigImage\": {\"description\": \"The container image to use for the manila config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionManilaScheduler\": {\"default\": \"overcloud-manila-scheduler\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"ManilaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/manila/manila-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerManilaSchedulerImage\": \"ContainerManilaSchedulerImage\", \"ContainerManilaConfigImage\": \"ContainerManilaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerManilaSchedulerImage\": {\"get_param\": \"ContainerManilaSchedulerImage\"}, \"ContainerManilaConfigImage\": {\"get_param\": \"ContainerManilaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Manila Scheduler role.\", \"value\": {\"service_name\": \"manila_scheduler\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionManilaScheduler\"}, \"config_settings\": {\"get_attr\": [\"ManilaBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"get_attr\": [\"ManilaBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"manila\", \"puppet_tags\": \"manila_config,manila_scheduler_paste_ini\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::manila::scheduler\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/manila_scheduler.json\": {\"command\": \"/usr/bin/manila-scheduler --config-file /usr/share/manila/manila-dist.conf --config-file /etc/manila/manila.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/manila\", \"owner\": \"manila:manila\", \"recurse\": true}]}}, \"docker_config\": {\"step_4\": {\"manila_scheduler\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaSchedulerImage\"]}, \"net\": \"host\", \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/manila_scheduler.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/manila:/var/log/manila:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/manila\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}], \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop manila scheduler container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"manila_scheduler\"], \"tripleo_delegate_to\": \"{{ groups['manila_scheduler'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-share-common.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Provides the list of Docker volumes and environment to be used by the ManilaShare service. The same list is used for HA and non-HA deployments.\\n\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ManilaCephFSCephFSProtocolHelperType\": {\"default\": \"CEPHFS\", \"description\": \"Protocol type ('CEPHFS' or 'NFS') when cephfs back end is enabled.  Set via manila cephfs environment files.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"CEPHFS\", \"NFS\"]}]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"conditions\": {\"cephfs_nfs_enabled\": {\"equals\": [{\"get_param\": \"ManilaCephFSCephFSProtocolHelperType\"}, \"NFS\"]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}}, \"outputs\": {\"manila_share_volumes\": {\"description\": \"Volumes for the manila-share container (HA or non-HA)\", \"value\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/manila_share.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/manila:/var/lib/kolla/config_files/src:ro\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, \"/dev:/dev\", \"/run:/run\", \"/sys:/sys\", \"/lib/modules:/lib/modules:ro\", \"/var/lib/manila:/var/lib/manila:z\", \"/var/log/containers/manila:/var/log/manila:z\"], {\"if\": [\"cephfs_nfs_enabled\", [\"/etc/ganesha:/etc/ganesha\", \"/run/dbus/system_bus_socket:/run/dbus/system_bus_socket\"]]}]}}, \"manila_share_environment\": {\"description\": \"Docker environment for the manila-share container (HA or non-HA)\", \"value\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-share-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Manila Share service\\n\", \"parameters\": {\"ContainerManilaShareImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerManilaConfigImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ManilaCephClientUserName\": {\"default\": \"manila\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"MonitoringSubscriptionManilaShare\": {\"default\": \"overcloud-manila-share\", \"type\": \"string\"}, \"ManilaPassword\": {\"description\": \"The password for the manila service account.\", \"type\": \"string\", \"hidden\": true}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"ManilaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/manila/manila-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"ManilaShareCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/manila/manila-share-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerManilaShareImage\": \"ContainerManilaShareImage\", \"ContainerManilaConfigImage\": \"ContainerManilaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerManilaShareImage\": {\"get_param\": \"ContainerManilaShareImage\"}, \"ContainerManilaConfigImage\": {\"get_param\": \"ContainerManilaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Manila Share role.\", \"value\": {\"service_name\": \"manila_share\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionManilaShare\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"ManilaBase\", \"role_data\", \"config_settings\"]}, {\"manila::keystone::authtoken::password\": {\"get_param\": \"ManilaPassword\"}, \"manila::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri\"]}, \"manila::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"manila::keystone::authtoken::project_name\": \"service\", \"manila::keystone::authtoken::user_domain_name\": \"Default\", \"manila::keystone::authtoken::project_domain_name\": \"Default\", \"manila::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"manila::keystone::authtoken::interface\": \"internal\", \"manila::compute::nova::username\": \"manila\", \"manila::compute::nova::password\": {\"get_param\": \"ManilaPassword\"}, \"manila::compute::nova::auth_type\": \"password\", \"manila::compute::nova::project_name\": \"service\", \"manila::compute::nova::user_domain_name\": \"Default\", \"manila::compute::nova::project_domain_name\": \"Default\", \"manila::compute::nova::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"manila::compute::nova::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"manila::network::neutron::username\": \"manila\", \"manila::network::neutron::password\": {\"get_param\": \"ManilaPassword\"}, \"manila::network::neutron::auth_type\": \"password\", \"manila::network::neutron::project_name\": \"service\", \"manila::network::neutron::user_domain_name\": \"Default\", \"manila::network::neutron::project_domain_name\": \"Default\", \"manila::network::neutron::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"manila::network::neutron::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"manila::volume::cinder::username\": \"manila\", \"manila::volume::cinder::password\": {\"get_param\": \"ManilaPassword\"}, \"manila::volume::cinder::auth_type\": \"password\", \"manila::volume::cinder::project_name\": \"service\", \"manila::volume::cinder::user_domain_name\": \"Default\", \"manila::volume::cinder::project_domain_name\": \"Default\", \"manila::volume::cinder::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"manila::volume::cinder::region_name\": {\"get_param\": \"KeystoneRegion\"}}]}, \"service_config_settings\": {\"get_attr\": [\"ManilaBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"manila\", \"puppet_tags\": \"manila_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::manila::share\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/manila_share.json\": {\"command\": \"/usr/bin/manila-share --config-file /usr/share/manila/manila-dist.conf --config-file /etc/manila/manila.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/manila\", \"owner\": \"manila:manila\", \"recurse\": true}, {\"path\": \"/var/lib/manila\", \"owner\": \"manila:manila\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"ManilaCephClientUserName\"}}}}, \"owner\": \"manila:manila\", \"perm\": \"0600\"}]}}, \"docker_config\": {\"step_4\": {\"manila_share\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"net\": \"host\", \"ipc\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"volumes\": {\"get_attr\": [\"ManilaShareCommon\", \"manila_share_volumes\"]}, \"environment\": {\"get_attr\": [\"ManilaShareCommon\", \"manila_share_environment\"]}}}}, \"host_prep_tasks\": [{\"name\": \"create fcontext entry for manila data\", \"community.general.sefcontext\": {\"target\": \"/var/lib/manila(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/manila\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/manila\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param:CephConfigPath\": null}, \"state\": \"directory\"}}], \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop manila share container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"manila_share\"], \"tripleo_delegate_to\": \"{{ groups['manila_share'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-share-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Manila Share service\\n\", \"parameters\": {\"ContainerManilaShareImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerManilaConfigImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"ManilaShareContainerBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/manila/manila-share-container-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"ManilaCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/manila/manila-share-common.yaml\"}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerManilaShareImage\": \"ContainerManilaShareImage\", \"ContainerManilaConfigImage\": \"ContainerManilaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerManilaShareImage\": {\"get_param\": \"ContainerManilaShareImage\"}, \"ContainerManilaConfigImage\": {\"get_param\": \"ContainerManilaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Manila Share role.\", \"value\": {\"service_name\": \"manila_share\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"ManilaShareContainerBase\", \"role_data\", \"config_settings\"]}, {\"tripleo::profile::pacemaker::manila::share_bundle::manila_share_docker_image\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/manila-share:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"tripleo::profile::pacemaker::manila::share_bundle::docker_volumes\": {\"get_attr\": [\"ManilaCommon\", \"manila_share_volumes\"]}, \"tripleo::profile::pacemaker::manila::share_bundle::docker_environment\": {\"get_attr\": [\"ManilaCommon\", \"manila_share_environment\"]}, \"tripleo::profile::pacemaker::manila::share_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::manila::share_bundle::ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"manila::share::manage_service\": false, \"manila::share::enabled\": false, \"manila::host\": \"hostgroup\"}]}, \"service_config_settings\": {\"get_attr\": [\"ManilaShareContainerBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"manila\", \"puppet_tags\": \"manila_config,file,concat,file_line\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::pacemaker::manila::share_bundle\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/manila_share.json\": {\"command\": \"/usr/bin/manila-share --config-file /usr/share/manila/manila-dist.conf --config-file /etc/manila/manila.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/manila\", \"owner\": \"manila:manila\", \"recurse\": true}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_3\": {\"manila_share_init_logs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/manila:/var/log/manila:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R manila:manila /var/log/manila\"]}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/manila\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/lib/manila\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}], \"deploy_steps_tasks\": [{\"name\": \"Manila Share tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"container_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/manila-share:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"Manila-Share HA Wrappers Step\", \"when\": \"step|int == 5\", \"block\": [{\"name\": \"Manila-Share puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"manila_share\", \"tripleo_ha_wrapper_resource_name\": \"openstack-manila-share\", \"tripleo_ha_wrapper_bundle_name\": \"openstack-manila-share\", \"tripleo_ha_wrapper_resource_state\": \"_ Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"manila\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::manila::share_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}]}], \"external_update_tasks\": [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get manila_share image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_manila_share_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-manila-share']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container manila_share image\", \"set_fact\": {\"manila_share_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"manila_share_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/manila-share:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_manila_share_image\": \"{{xmllint_pcmk_manila_share_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"manila_share\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"manila-share temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"manila_share\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"openstack-manila-share\", \"tripleo_ha_image_update_new_image\": \"{{manila_share_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_manila_share_image}}\"}, \"when\": [\"(pcmk_manila_share_image != \\\"\\\")\", \"(pcmk_manila_share_image != manila_share_image_latest)\"]}]}], \"update_tasks\": [{\"block\": [{\"name\": \"Get manila_share image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_manila_share_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-manila-share']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container manila_share image\", \"set_fact\": {\"manila_share_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"manila_share_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/manila-share:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_manila_share_image\": \"{{xmllint_pcmk_manila_share_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of manila-share container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_manila_share_image == manila_share_image_latest\", \"fail_msg\": \"manila-share image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"manila_share fetch and retag container image for pacemaker\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Retag pcmklatest to latest manila_share image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{manila_share_image}}\", \"container_image_latest\": \"{{manila_share_image_latest}}\"}}]}], \"post_update_tasks\": [{\"name\": \"Manila-share bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Manila-Share puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"manila_share\", \"tripleo_ha_wrapper_resource_name\": \"openstack-manila-share\", \"tripleo_ha_wrapper_bundle_name\": \"openstack-manila-share\", \"tripleo_ha_wrapper_resource_state\": \"_ Started\", \"tripleo_ha_wrapper_puppet_config_volume\": \"manila\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::manila::share_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ip,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}], \"upgrade_tasks\": [{\"name\": \"Prepare switch of manila_share image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get manila_share image id currently used by pacemaker\", \"shell\": \"pcs resource config openstack-manila-share | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"manila_share_image_current_res\", \"failed_when\": false}, {\"name\": \"manila_share image facts\", \"set_fact\": {\"manila_share_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/manila-share:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"manila_share_image_current\": \"{{manila_share_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current manila_share image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{manila_share_image_current}}\", \"container_image_latest\": \"{{manila_share_image_latest}}\", \"pull_image\": false}, \"when\": [\"manila_share_image_current != ''\", \"manila_share_image_current != manila_share_image_latest\"]}, {\"name\": \"Create manila_share retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/manila_share_needs_retag\", \"state\": \"touch\"}, \"when\": [\"manila_share_image_current != ''\", \"manila_share_image_current != manila_share_image_latest\"]}]}, {\"name\": \"Update openstack-manila-share pcs resource bundle for new container image\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"set is_manila_share_bootstrap_node fact\", \"tags\": \"common\", \"set_fact\": \"is_manila_share_bootstrap_node={{manila_share_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}, {\"name\": \"Check for manila_share retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/manila_share_needs_retag\"}, \"register\": \"manila_share_retag_state_file\"}]}, {\"name\": \"Update openstack-manila-share pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_manila_share_bootstrap_node\", \"manila_share_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the manila_share cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"openstack-manila-share\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"pcs resource bundle update manila_share for new container image name\", \"command\": \"pcs resource bundle update openstack-manila-share container image={{manila_share_image_latest}}\"}, {\"name\": \"Enable the manila_share cluster resource\", \"pacemaker_resource\": {\"resource\": \"openstack-manila-share\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}, {\"name\": \"Check for manila_share retag statefile\", \"when\": [\"step|int == 3\"], \"stat\": {\"path\": \"/var/lib/tripleo/manila_share_needs_retag\"}, \"register\": \"manila_share_retag_state_file\"}, {\"name\": \"Retag openstack-manila-share container image\", \"when\": [\"step|int == 3\"], \"block\": [{\"name\": \"Disable the manila_share cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"openstack-manila-share\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Retag the pacemaker image if containerized\", \"block\": [{\"block\": [{\"name\": \"Get manila_share image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_manila_share_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='openstack-manila-share']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container manila_share image\", \"set_fact\": {\"manila_share_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"manila_share_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/manila-share:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerManilaShareImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_manila_share_image\": \"{{xmllint_pcmk_manila_share_image.stdout}}\"}}]}, {\"block\": [{\"name\": \"Retag pcmklatest to latest manila_share image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{manila_share_image}}\", \"container_image_latest\": \"{{manila_share_image_latest}}\"}}]}]}, {\"name\": \"Enable the manila_share cluster resource\", \"pacemaker_resource\": {\"resource\": \"openstack-manila-share\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Remove manila_share retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/manila_share_needs_retag\", \"state\": \"absent\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/manila/manila-backend-cephfs.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Openstack Manila Cephfs backend\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"ManilaCephFSDataPoolName\": {\"default\": \"manila_data\", \"type\": \"string\"}, \"ManilaCephFSBackendName\": {\"type\": \"string\", \"default\": \"cephfs\"}, \"ManilaCephFSFileSystemName\": {\"type\": \"string\", \"default\": \"cephfs\"}, \"ManilaCephFSAvailabilityZone\": {\"default\": \"\", \"description\": \"The availability zone of the CephFS backend. When set, it overrides the default ManilaStorageAvailabilityZone.\\n\", \"type\": \"string\"}, \"ManilaCephFSDriverHandlesShareServers\": {\"type\": \"boolean\", \"default\": false}, \"ManilaCephFSShareBackendName\": {\"type\": \"string\", \"default\": \"cephfs\"}, \"ManilaCephFSCephFSAuthId\": {\"type\": \"string\", \"default\": \"manila\"}, \"ManilaCephFSCephVolumeMode\": {\"type\": \"string\", \"default\": \"0755\"}, \"ManilaCephFSCephFSProtocolHelperType\": {\"default\": \"CEPHFS\", \"description\": \"Protocol type ('CEPHFS' or 'NFS') when cephfs back end is enabled.  Set via manila cephfs environment files.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"CEPHFS\", \"NFS\"]}]}, \"ManilaCephFSCephFSEnableSnapshots\": {\"type\": \"boolean\", \"description\": \"Enable snapshot support in CephFS driver. Note that this parameter has\\nno effect now and snapshot support is always enabled.\\n\", \"default\": false}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"ManilaCephFSCephFSEnableSnapshots\"]}], \"outputs\": {\"role_data\": {\"description\": \"Role data for the Manila Cephfs backend.\", \"value\": {\"service_name\": \"manila_backend_cephfs\", \"config_settings\": {\"map_merge\": [{\"manila::backend::cephfs::title\": {\"get_param\": \"ManilaCephFSBackendName\"}, \"manila::backend::cephfs::driver_handles_share_servers\": {\"get_param\": \"ManilaCephFSDriverHandlesShareServers\"}, \"manila::backend::cephfs::pool_name\": {\"get_param\": \"ManilaCephFSDataPoolName\"}, \"manila::backend::cephfs::share_backend_name\": {\"get_param\": \"ManilaCephFSShareBackendName\"}, \"manila::backend::cephfs::cephfs_filesystem_name\": {\"get_param\": \"ManilaCephFSFileSystemName\"}, \"manila_cephfs_ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"manila::backend::cephfs::cephfs_conf_path\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"manila::backend::cephfs::cephfs_auth_id\": {\"get_param\": \"ManilaCephFSCephFSAuthId\"}, \"manila::backend::cephfs::cephfs_cluster_name\": {\"get_param\": \"CephClusterName\"}, \"manila::backend::cephfs::cephfs_volume_mode\": {\"get_param\": \"ManilaCephFSCephVolumeMode\"}, \"manila::backend::cephfs::cephfs_protocol_helper_type\": {\"get_param\": \"ManilaCephFSCephFSProtocolHelperType\"}}, {\"if\": [{\"equals\": [{\"get_param\": \"ManilaCephFSAvailabilityZone\"}, \"\"]}, {}, {\"manila::backend::cephfs::backend_availability_zone\": {\"get_param\": \"ManilaCephFSAvailabilityZone\"}}]}]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/providers/ovn-provider-config.yaml": "{\"heat_template_version\": \"wallaby\", \"parameters\": {\"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"NeutronMechanismDrivers\": {\"default\": \"ovn\", \"description\": \"The mechanism drivers for the Neutron tenant network.\\n\", \"type\": \"comma_delimited_list\"}, \"OctaviaOvnProviderProtocol\": {\"default\": \"\", \"description\": \"The protocol used by OVN driver to connect to northbound database.\\n\", \"type\": \"string\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"OctaviaCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"is_ovn_in_neutron_mechanism_driver\": {\"contains\": [\"ovn\", {\"get_param\": \"NeutronMechanismDrivers\"}]}, \"ovn_and_tls\": {\"and\": [\"is_ovn_in_neutron_mechanism_driver\", \"internal_tls_enabled\"]}, \"octavia_provider_ovn_protocol_unset\": {\"equals\": [{\"get_param\": \"OctaviaOvnProviderProtocol\"}, \"\"]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"OctaviaCertificateKeySize\"}, \"\"]}}, \"outputs\": {\"role_data\": {\"description\": \"OVN provider driver configuraton\", \"value\": {\"config_settings\": {\"map_merge\": [{\"if\": [\"is_ovn_in_neutron_mechanism_driver\", {\"octavia::driver_agent::enabled_provider_agents\": \"ovn\"}, {}]}, {\"if\": [\"octavia_provider_ovn_protocol_unset\", {\"if\": [\"internal_tls_enabled\", {\"tripleo::profile::base::octavia::provider::ovn::protocol\": \"ssl\"}, {\"tripleo::profile::base::octavia::provider::ovn::protocol\": \"tcp\"}]}, {\"tripleo::profile::base::octavia::provider::ovn::protocol\": {\"get_param\": \"OctaviaOvnProviderProtocol\"}}]}, {\"if\": [\"ovn_and_tls\", {\"tripleo::profile::base::octavia::provider::ovn::ovn_nb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo::profile::base::octavia::provider::ovn::ovn_nb_certificate\": \"/etc/pki/tls/certs/ovn_octavia.crt\", \"tripleo::profile::base::octavia::provider::ovn::ovn_nb_private_key\": \"/etc/pki/tls/private/ovn_octavia.key\", \"tripleo::profile::base::octavia::provider::ovn::ovn_sb_ca_cert\": {\"get_param\": \"InternalTLSCAFile\"}, \"tripleo::profile::base::octavia::provider::ovn::ovn_sb_certificate\": \"/etc/pki/tls/certs/ovn_octavia.crt\", \"tripleo::profile::base::octavia::provider::ovn::ovn_sb_private_key\": \"/etc/pki/tls/private/ovn_octavia.key\"}, {}]}]}, \"puppet_tags\": \"octavia_ovn_provider_config\", \"provider_driver_labels\": {\"if\": [\"is_ovn_in_neutron_mechanism_driver\", [\"ovn: Octavia OVN driver.\"], []]}, \"step_config\": {\"if\": [\"is_ovn_in_neutron_mechanism_driver\", \"include tripleo::profile::base::octavia::provider::ovn\", \"\\n\"]}, \"metadata_settings\": {\"if\": [\"ovn_and_tls\", [{\"service\": \"ovn_octavia\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}, \"type\": \"node\"}], null]}, \"volumes\": {\"if\": [\"ovn_and_tls\", [\"/etc/pki/tls/certs/ovn_octavia.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/ovn_octavia.crt:ro\", \"/etc/pki/tls/private/ovn_octavia.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/ovn_octavia.key:ro\"], []]}, \"kolla_permissions\": {\"if\": [\"ovn_and_tls\", [{\"path\": \"/etc/pki/tls/certs/ovn_octavia.crt\", \"owner\": \"octavia:octavia\", \"perm\": \"0644\"}, {\"path\": \"/etc/pki/tls/private/ovn_octavia.key\", \"owner\": \"octavia:octavia\", \"perm\": \"0640\"}], []]}, \"kolla_config_files\": {\"if\": [\"ovn_and_tls\", [{\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], []]}, \"deploy_steps_tasks\": {\"if\": [\"ovn_and_tls\", [{\"name\": \"Certificate generation\", \"when\": \"step|int == 1\", \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"ovn_octavia\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"ovn_octavia/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OvnDbsNetwork\"]}}}}, \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"OctaviaCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], null]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Octavia base service. Shared for all Octavia services\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"OctaviaDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Octavia services.\", \"type\": \"boolean\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"EnableConfigPurge\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Remove configuration that is not generated by TripleO. Used to avoid configuration remnants after upgrades.\\n\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"OctaviaUserName\": {\"description\": \"The username for the Octavia database and keystone accounts.\", \"type\": \"string\", \"default\": \"octavia\"}, \"OctaviaPassword\": {\"description\": \"The password for the Octavia database and keystone accounts.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaProjectName\": {\"description\": \"The project name for the keystone Octavia account.\", \"type\": \"string\", \"default\": \"service\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"OctaviaCaCertFile\": {\"type\": \"string\", \"default\": \"/etc/octavia/certs/ca_01.pem\", \"description\": \"Octavia CA certificate file path.\"}, \"OctaviaCaCert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Octavia CA certificate data. If provided, this will create or update a file on the host with the path provided in OctaviaCaCertFile with the certificate data.\"}, \"OctaviaCaKeyFile\": {\"type\": \"string\", \"default\": \"/etc/octavia/certs/private/cakey.pem\", \"description\": \"Octavia CA private key file path.\"}, \"OctaviaCaKey\": {\"type\": \"string\", \"default\": \"\", \"description\": \"The private key for the certificate provided in OctaviaCaCert. If provided, this will create or update a file on the host with the path provided in OctaviaCaKeyFile with the key data.\"}, \"OctaviaClientCertFile\": {\"type\": \"string\", \"default\": \"/etc/octavia/certs/client.pem\", \"description\": \"Octavia client certificate for amphorae.\"}, \"OctaviaClientCert\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Octavia client certificate data. If provided, this will create or update a file on the host with the path provided in OctaviaClientCertFile with the certificate data.\"}, \"OctaviaServerCertsKeyPassphrase\": {\"constraints\": [{\"length\": {\"min\": 32, \"max\": 32}}], \"description\": \"Passphrase for encrypting Amphora Certificates and Private Keys. Must be exactly 32 characters.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaCaKeyPassphrase\": {\"description\": \"CA private key passphrase.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaAmphoraImageTag\": {\"default\": \"amphora-image\", \"description\": \"Glance image tag for identifying the amphora image.\", \"type\": \"string\"}, \"OctaviaAmphoraNetworkList\": {\"default\": [], \"description\": \"List of networks to attach to amphorae.\", \"type\": \"comma_delimited_list\"}, \"OctaviaAmphoraSshKeyName\": {\"type\": \"string\", \"default\": \"octavia-ssh-key\", \"description\": \"SSH key name.\"}, \"OctaviaLoadBalancerTopology\": {\"default\": \"\", \"description\": \"Load balancer topology configuration.\", \"type\": \"string\"}, \"OctaviaFlavorId\": {\"default\": \"65\", \"description\": \"Nova flavor ID to be used when creating the nova flavor for amphora.\", \"type\": \"string\"}, \"OctaviaTimeoutClientData\": {\"default\": 50000, \"description\": \"Frontend client inactivity timeout.\", \"type\": \"number\"}, \"OctaviaTimeoutMemberConnect\": {\"default\": 5000, \"description\": \"Backend member connection timeout.\", \"type\": \"number\"}, \"OctaviaTimeoutMemberData\": {\"default\": 50000, \"description\": \"Backend member inactivity timeout.\", \"type\": \"number\"}, \"OctaviaTimeoutTcpInspect\": {\"default\": 0, \"description\": \"Time to wait for TCP packets for content inspection.\", \"type\": \"number\"}, \"OctaviaConnectionMaxRetries\": {\"default\": 120, \"description\": \"Retry threshold for connecting to amphorae.\", \"type\": \"number\"}, \"OctaviaConnectionLogging\": {\"default\": true, \"description\": \"When false, tenant connection flows will not be logged.\", \"type\": \"boolean\"}, \"OctaviaBuildActiveRetries\": {\"default\": 120, \"description\": \"Retry threshold for waiting for a build slot for an amphorae.\", \"type\": \"number\"}, \"OctaviaPortDetachTimeout\": {\"default\": 300, \"description\": \"Seconds to wait for a port to detach from an amphora.\", \"type\": \"number\"}, \"OctaviaAdminLogFacility\": {\"default\": 1, \"description\": \"The syslog \\\"LOG_LOCAL\\\" facility to use for the administrative log messages.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 0, \"max\": 7}, \"description\": \"Facility must be between 0 and 7.\"}]}, \"OctaviaForwardAllLogs\": {\"default\": false, \"description\": \"When true, all log messages from the amphora will be forwarded to the administrative log endponts, including non-load balancing related logs.\", \"type\": \"boolean\"}, \"OctaviaTenantLogFacility\": {\"default\": 0, \"description\": \"The syslog \\\"LOG_LOCAL\\\" facility to use for the tenant traffic flow log messages.\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 0, \"max\": 7}, \"description\": \"Facility must be between 0 and 7.\"}]}, \"OctaviaUserLogFormat\": {\"default\": \"\", \"description\": \"The tenant traffic flow log format string.\", \"type\": \"string\"}, \"OctaviaDisableLocalLogStorage\": {\"default\": false, \"description\": \"When true, logs will not be stored on the amphora filesystem. This includes all kernel, system, and security logs.\", \"type\": \"boolean\"}, \"OctaviaAntiAffinity\": {\"default\": true, \"description\": \"Flag to indicate if anti-affinity feature is turned on.\", \"type\": \"boolean\"}, \"OctaviaEnableJobboard\": {\"default\": false, \"description\": \"Enable jobboard for the amphorav2 driver, it enables flow resumption for the amphora driver.\", \"type\": \"boolean\"}, \"OctaviaJobboardExpirationTime\": {\"default\": 30, \"description\": \"Expiry of claimed jobs in jobboard.\", \"type\": \"number\"}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}}, \"conditions\": {\"octavia_ca_cert_unset\": {\"equals\": [{\"get_param\": \"OctaviaCaCert\"}, \"\"]}, \"octavia_ca_key_unset\": {\"equals\": [{\"get_param\": \"OctaviaCaKey\"}, \"\"]}, \"octavia_client_cert_unset\": {\"equals\": [{\"get_param\": \"OctaviaClientCert\"}, \"\"]}, \"octavia_topology_unset\": {\"equals\": [{\"get_param\": \"OctaviaLoadBalancerTopology\"}, \"\"]}, \"enable_sqlalchemy_collectd\": {\"equals\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, true]}, \"octavia_user_log_format_set\": {\"not\": {\"equals\": [{\"get_param\": \"OctaviaUserLogFormat\"}, \"\"]}}}, \"outputs\": {\"role_data\": {\"description\": \"Base role data for Octavia services\", \"value\": {\"service_name\": \"octavia_base\", \"config_settings\": {\"map_merge\": [{\"octavia::logging::debug\": {\"if\": [{\"get_param\": \"OctaviaDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"octavia::purge_config\": {\"get_param\": \"EnableConfigPurge\"}, \"octavia::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"octavia::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": {\"get_param\": \"OctaviaUserName\"}, \"password\": {\"get_param\": \"OctaviaPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/octavia\", \"query\": {\"if\": [\"enable_sqlalchemy_collectd\", {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"octavia\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"octavia::service_auth::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"octavia::service_auth::auth_type\": \"password\", \"octavia::service_auth::username\": {\"get_param\": \"OctaviaUserName\"}, \"octavia::service_auth::password\": {\"get_param\": \"OctaviaPassword\"}, \"octavia::service_auth::project_name\": {\"get_param\": \"OctaviaProjectName\"}, \"octavia::service_auth::project_domain_name\": \"Default\", \"octavia::service_auth::user_domain_name\": \"Default\", \"octavia::service_auth::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"octavia::nova::endpoint_type\": \"internalURL\", \"octavia::neutron::endpoint_type\": \"internalURL\", \"octavia::glance::endpoint_type\": \"internalURL\", \"octavia::cinder::endpoint_type\": \"internalURL\", \"octavia::certificates::endpoint_type\": \"internalURL\", \"octavia::certificates::ca_certificate\": {\"get_param\": \"OctaviaCaCertFile\"}, \"octavia::certificates::ca_private_key\": {\"get_param\": \"OctaviaCaKeyFile\"}, \"octavia::certificates::client_cert\": {\"get_param\": \"OctaviaClientCertFile\"}, \"octavia::certificates::server_certs_key_passphrase\": {\"get_param\": \"OctaviaServerCertsKeyPassphrase\"}, \"octavia::certificates::ca_private_key_passphrase\": {\"get_param\": \"OctaviaCaKeyPassphrase\"}, \"octavia::worker::manage_nova_flavor\": false, \"octavia::controller::amp_boot_network_list\": {\"get_param\": \"OctaviaAmphoraNetworkList\"}, \"octavia::controller::amp_flavor_id\": {\"get_param\": \"OctaviaFlavorId\"}, \"octavia::controller::amp_image_tag\": {\"get_param\": \"OctaviaAmphoraImageTag\"}, \"octavia::controller::amp_ssh_key_name\": {\"get_param\": \"OctaviaAmphoraSshKeyName\"}, \"octavia::controller::enable_ssh_access\": true, \"octavia::controller::timeout_client_data\": {\"get_param\": \"OctaviaTimeoutClientData\"}, \"octavia::controller::timeout_member_connect\": {\"get_param\": \"OctaviaTimeoutMemberConnect\"}, \"octavia::controller::timeout_member_data\": {\"get_param\": \"OctaviaTimeoutMemberData\"}, \"octavia::controller::timeout_tcp_inspect\": {\"get_param\": \"OctaviaTimeoutTcpInspect\"}, \"octavia::controller::connection_max_retries\": {\"get_param\": \"OctaviaConnectionMaxRetries\"}, \"octavia::controller::connection_logging\": {\"get_param\": \"OctaviaConnectionLogging\"}, \"octavia::controller::build_active_retries\": {\"get_param\": \"OctaviaBuildActiveRetries\"}, \"octavia::controller::port_detach_timeout\": {\"get_param\": \"OctaviaPortDetachTimeout\"}, \"octavia::controller::administrative_log_facility\": {\"get_param\": \"OctaviaAdminLogFacility\"}, \"octavia::controller::forward_all_logs\": {\"get_param\": \"OctaviaForwardAllLogs\"}, \"octavia::controller::user_log_facility\": {\"get_param\": \"OctaviaTenantLogFacility\"}, \"octavia::controller::user_log_format\": {\"if\": [\"octavia_user_log_format_set\", {\"get_param\": \"OctaviaUserLogFormat\"}]}, \"octavia::controller::disable_local_log_storage\": {\"get_param\": \"OctaviaDisableLocalLogStorage\"}, \"octavia::nova::enable_anti_affinity\": {\"get_param\": \"OctaviaAntiAffinity\"}, \"octavia::rabbit_heartbeat_in_pthread\": false}, {\"if\": [\"octavia_topology_unset\", {}, {\"octavia::controller::loadbalancer_topology\": {\"get_param\": \"OctaviaLoadBalancerTopology\"}}]}, {\"if\": [\"octavia_ca_cert_unset\", {}, {\"octavia::certificates::ca_certificate_data\": {\"get_param\": \"OctaviaCaCert\"}}]}, {\"if\": [\"octavia_ca_key_unset\", {}, {\"octavia::certificates::ca_private_key_data\": {\"get_param\": \"OctaviaCaKey\"}}]}, {\"if\": [\"octavia_client_cert_unset\", {}, {\"octavia::certificates::client_cert_data\": {\"get_param\": \"OctaviaClientCert\"}}]}, {\"if\": [{\"get_param\": \"OctaviaEnableJobboard\"}, {\"octavia::task_flow::jobboard_enabled\": {\"get_param\": \"OctaviaEnableJobboard\"}, \"octavia::task_flow::jobboard_backend_hosts\": \"%{hiera('redis_vip')}\", \"octavia::task_flow::jobboard_backend_password\": {\"get_param\": \"RedisPassword\"}, \"octavia::task_flow::jobboard_expiration_time\": {\"get_param\": \"OctaviaJobboardExpirationTime\"}, \"octavia::task_flow::persistence_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": {\"get_param\": \"OctaviaUserName\"}, \"password\": {\"get_param\": \"OctaviaPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/octavia_persistence\", \"query\": {\"if\": [\"enable_sqlalchemy_collectd\", {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"octavia\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}}]}]}, \"update_tasks\": [{\"name\": \"make sure that post-deploy.conf exists before restarting containers on update or upgrade\", \"when\": \"step|int == 5\", \"block\": [{\"name\": \"check for octavia post-deploy.conf file\", \"stat\": {\"path\": \"/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf\"}, \"register\": \"octavia_post_deploy_stat\"}, {\"name\": \"create an empty post-deploy.conf file if it does not exist\", \"file\": {\"path\": \"/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf\", \"state\": \"touch\", \"setype\": \"container_file_t\", \"mode\": \"0755\"}, \"when\": [\"octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists\"]}]}], \"upgrade_tasks\": [{\"name\": \"make sure that post-deploy.conf exists before restarting containers on update or upgrade\", \"when\": \"step|int == 5\", \"block\": [{\"name\": \"check for octavia post-deploy.conf file\", \"stat\": {\"path\": \"/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf\"}, \"register\": \"octavia_post_deploy_stat\"}, {\"name\": \"create an empty post-deploy.conf file if it does not exist\", \"file\": {\"path\": \"/var/lib/config-data/puppet-generated/octavia/etc/octavia/post-deploy.conf\", \"state\": \"touch\", \"setype\": \"container_file_t\", \"mode\": \"0755\"}, \"when\": [\"octavia_post_deploy_stat.exists is defined and not octavia_post_deploy_stat.exists\"]}]}, {\"name\": \"pre-check to ensure redis is removed if the service is disabled\", \"when\": [\"step|int == 0\", \"\\\"redis\\\" not in enabled_services|list\", \"\\\"pacemaker\\\" in enabled_services|list\"], \"become\": true, \"shell\": \"export CIB_file=/var/lib/pacemaker/cib/cib.xml\\nif crm_resource -r redis-bundle -q &>/dev/null; then\\n  echo \\\"Redis resource present in pacemaker but disabled by default in TripleO\\\" >&2\\n  echo \\\"Delete the resource in pacemaker or enable the redis service before upgrading\\\" >&2\\n  exit 1\\nfi\"}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-worker-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Octavia worker service configured with Puppet\\n\", \"parameters\": {\"ContainerOctaviaWorkerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOctaviaConfigImage\": {\"description\": \"The container image to use for the octavia config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"OctaviaWorkerLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.octavia.worker\", \"file\": \"/var/log/containers/octavia/worker.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnablePackageInstall\": {\"default\": \"false\", \"description\": \"Set to true to enable package installation at deploy time\", \"type\": \"boolean\"}, \"MonitoringSubscriptionOctaviaWorker\": {\"default\": \"overcloud-octavia-worker\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"OctaviaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerOctaviaWorkerImage\": \"ContainerOctaviaWorkerImage\", \"ContainerOctaviaConfigImage\": \"ContainerOctaviaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerOctaviaWorkerImage\": {\"get_param\": \"ContainerOctaviaWorkerImage\"}, \"ContainerOctaviaConfigImage\": {\"get_param\": \"ContainerOctaviaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Octavia worker role.\", \"value\": {\"service_name\": \"octavia_worker\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionOctaviaWorker\"}, \"config_settings\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_octavia_worker\": [{\"get_param\": \"OctaviaWorkerLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"octavia\", \"puppet_tags\": \"octavia_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"['nova_flavor'].each |String $val| { noop_resource($val) }\", \"include tripleo::profile::base::octavia::worker\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/octavia_worker.json\": {\"command\": \"/usr/bin/octavia-worker --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --config-file /etc/octavia/post-deploy.conf --log-file /var/log/octavia/worker.log --config-dir /etc/octavia/conf.d/octavia-worker\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"octavia_worker_init_dirs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaWorkerImage\"]}, \"user\": \"root\", \"net\": \"none\", \"volumes\": [\"/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z\"], \"command\": [\"/bin/bash\", \"-c\", \"mkdir -p /etc/octavia/conf.d/octavia-worker; chown -R octavia:octavia /etc/octavia/conf.d/octavia-worker\"]}}, \"step_5\": {\"octavia_worker\": {\"start_order\": 2, \"stop_grace_period\": 630, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaWorkerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_worker.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia:/var/log/octavia:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/octavia\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"block\": [{\"name\": \"Ensure packages required for configuring octavia are present\", \"package\": {\"name\": [\"python3-neutronclient\", \"python3-openstackclient\", \"python3-octaviaclient\", \"openssl\"], \"state\": \"present\"}}], \"when\": {\"get_param\": \"EnablePackageInstall\"}}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}], \"update_tasks\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"update_tasks\"]}, \"upgrade_tasks\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"upgrade_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop octavia api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"octavia_worker\"], \"tripleo_delegate_to\": \"{{ groups['octavia_worker'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Octavia service configured with Puppet\\n\", \"parameters\": {\"ContainerOctaviaApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOctaviaConfigImage\": {\"description\": \"The container image to use for the octavia config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"OctaviaApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.octavia.api\", \"file\": \"/var/log/containers/octavia/octavia.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"OctaviaUserName\": {\"description\": \"The username for the Octavia database and keystone accounts.\", \"type\": \"string\", \"default\": \"octavia\"}, \"OctaviaPassword\": {\"description\": \"The password for the Octavia database and keystone accounts.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaProjectName\": {\"description\": \"The project name for the keystone Octavia account.\", \"type\": \"string\", \"default\": \"service\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionOctaviaApi\": {\"default\": \"overcloud-octavia-api\", \"type\": \"string\"}, \"OctaviaApiPolicies\": {\"description\": \"A hash of policies to configure for Octavia API.\\ne.g. { octavia-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"OctaviaEnableDriverAgent\": {\"default\": true, \"description\": \"Set to false if the driver agent needs to be disabled for some reason.\", \"type\": \"boolean\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}, \"OctaviaDefaultListenerCiphers\": {\"type\": \"comma_delimited_list\", \"description\": \"Default list of OpenSSL ciphers for new TLS-enabled listeners.\\n\", \"default\": []}, \"OctaviaDefaultPoolCiphers\": {\"type\": \"comma_delimited_list\", \"description\": \"Default list of OpenSSL ciphers for new TLS-enabled pools.\\n\", \"default\": []}, \"OctaviaTlsCiphersProhibitList\": {\"type\": \"comma_delimited_list\", \"description\": \"List of OpenSSL ciphers. Usage of these ciphers will be blocked.\\n\", \"default\": []}, \"OctaviaListenerTlsVersions\": {\"type\": \"comma_delimited_list\", \"description\": \"List of OpenSSL cipher string of TLS versions to use for new TLS-enabled listeners.\\n\", \"default\": [\"TLSv1.2\", \"TLSv1.3\"]}, \"OctaviaPoolTlsVersions\": {\"type\": \"comma_delimited_list\", \"description\": \"List of TLS versions to use for new TLS-enabled pools.\\n\", \"default\": [\"TLSv1.2\", \"TLSv1.3\"]}, \"OctaviaMinimumTlsVersion\": {\"type\": \"string\", \"description\": \"Minimum allowed TLS version for listeners and pools.\\n\", \"default\": \"\"}}, \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"use_tls_proxy\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"enable_driver_agent\": {\"equals\": [{\"get_param\": \"OctaviaEnableDriverAgent\"}, true]}, \"octavia_default_listener_ciphers_set\": {\"not\": {\"equals\": [{\"get_param\": \"OctaviaDefaultListenerCiphers\"}, []]}}, \"octavia_default_pool_ciphers_set\": {\"not\": {\"equals\": [{\"get_param\": \"OctaviaDefaultPoolCiphers\"}, []]}}, \"octavia_min_tls_version_set\": {\"not\": {\"equals\": [{\"get_param\": \"OctaviaMinimumTlsVersion\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"OctaviaProviderConfig\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/octavia/providers/ovn-provider-config.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"OctaviaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"OctaviaWorker\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-worker-container-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerOctaviaApiImage\": \"ContainerOctaviaApiImage\", \"ContainerOctaviaConfigImage\": \"ContainerOctaviaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerOctaviaApiImage\": {\"get_param\": \"ContainerOctaviaApiImage\"}, \"ContainerOctaviaConfigImage\": {\"get_param\": \"ContainerOctaviaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Octavia API role.\", \"value\": {\"service_name\": \"octavia_api\", \"firewall_rules\": {\"120 octavia api\": {\"dport\": [9876]}}, \"firewall_frontend_rules\": {\"100 octavia_haproxy_frontend\": {\"dport\": [9876]}}, \"firewall_ssl_frontend_rules\": {\"100 octavia_haproxy_frontend_ssl\": {\"dport\": [13876]}}, \"keystone_resources\": {\"octavia\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"OctaviaPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"OctaviaInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"OctaviaAdmin\", \"uri\"]}}, \"project\": {\"get_param\": \"OctaviaProjectName\"}, \"users\": {\"octavia\": {\"name\": {\"get_param\": \"OctaviaUserName\"}, \"password\": {\"get_param\": \"OctaviaPassword\"}, \"project\": {\"get_param\": \"OctaviaProjectName\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"load-balancer\", \"roles\": [\"load-balancer_admin\", \"load-balancer_quota_admin\", \"load-balancer_member\", \"load-balancer_global_observer\", \"load-balancer_observer\"]}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionOctaviaApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"OctaviaBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"OctaviaWorker\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"config_settings\"]}, {\"octavia::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"octavia::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"octavia::keystone::authtoken::project_name\": {\"get_param\": \"OctaviaProjectName\"}, \"octavia::keystone::authtoken::password\": {\"get_param\": \"OctaviaPassword\"}, \"octavia::keystone::authtoken::user_domain_name\": \"Default\", \"octavia::keystone::authtoken::project_domain_name\": \"Default\", \"octavia::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"octavia::keystone::authtoken::interface\": \"internal\", \"octavia::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"octavia::policy::policies\": {\"get_param\": \"OctaviaApiPolicies\"}, \"octavia::api::service_name\": \"httpd\", \"octavia::api::enable_proxy_headers_parsing\": true, \"octavia::api::healthcheck_enabled\": true, \"octavia::api::tls_cipher_prohibit_list\": {\"get_param\": \"OctaviaTlsCiphersProhibitList\"}, \"octavia::api::default_listener_tls_versions\": {\"get_param\": \"OctaviaListenerTlsVersions\"}, \"octavia::api::default_pool_tls_versions\": {\"get_param\": \"OctaviaPoolTlsVersions\"}, \"octavia::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"octavia::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}}}, \"octavia::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}}}, \"octavia::api::host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"OctaviaApiNetwork\"]}}}}, \"tripleo::profile::base::octavia::enable_driver_agent\": {\"get_param\": \"OctaviaEnableDriverAgent\"}, \"octavia::api::provider_drivers\": {\"list_join\": [\",\", {\"list_concat\": [[\"amphora: The Octavia Amphora driver.\", \"octavia: Deprecated alias of the Octavia Amphora driver.\"], {\"if\": [\"enable_driver_agent\", {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"provider_driver_labels\"]}, []]}]}]}}, {\"if\": [\"octavia_default_listener_ciphers_set\", {\"octavia::api::default_listener_ciphers\": {\"get_param\": \"OctaviaDefaultListenerCiphers\"}}]}, {\"if\": [\"octavia_default_pool_ciphers_set\", {\"octavia::api::default_pool_ciphers\": {\"get_param\": \"OctaviaDefaultPoolCiphers\"}}]}, {\"if\": [\"octavia_min_tls_version_set\", {\"octavia::api::minimum_tls_version\": {\"get_param\": \"OctaviaMinimumTlsVersion\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_octavia_api\": [{\"get_param\": \"OctaviaApiLoggingSource\"}]}, \"mysql\": {\"octavia::db::mysql::password\": {\"get_param\": \"OctaviaPassword\"}, \"octavia::db::mysql::user\": {\"get_param\": \"OctaviaUserName\"}, \"octavia::db::mysql::host\": \"%\", \"octavia::db::mysql::dbname\": \"octavia\", \"octavia::db::mysql::persistence_dbname\": \"octavia_persistence\"}}, \"puppet_config\": {\"config_volume\": \"octavia\", \"puppet_tags\": {\"list_join\": [\",\", [\"octavia_config\", {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"puppet_tags\"]}]]}, \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::octavia::api\", {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"step_config\"]}, {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/octavia_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": {\"list_concat\": [[{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"kolla_config_files\"]}]}, \"permissions\": {\"list_concat\": [[{\"path\": \"/var/log/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}, {\"path\": \"/run/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"kolla_permissions\"]}]}}, \"/var/lib/kolla/config_files/octavia_driver_agent.json\": {\"command\": \"/usr/bin/octavia-driver-agent --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --log-file /var/log/octavia/driver-agent.log --config-dir /etc/octavia/conf.d/common\", \"config_files\": {\"list_concat\": [[{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"kolla_config_files\"]}]}, \"permissions\": {\"list_concat\": [[{\"path\": \"/var/log/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}, {\"path\": \"/run/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"kolla_permissions\"]}]}}, \"/var/lib/kolla/config_files/octavia_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec octavia_api su octavia -s /bin/bash -c '/usr/bin/octavia-db-manage upgrade head && /usr/bin/octavia-db-manage upgrade_persistence'\", \"config_files\": {\"list_concat\": [[{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"kolla_config_files\"]}]}, \"permissions\": {\"list_concat\": [[{\"path\": \"/var/log/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}, {\"path\": \"/run/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"kolla_permissions\"]}]}}}, \"metadata_settings\": {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"deploy_steps_tasks\"]}, \"docker_config\": {\"step_2\": {\"octavia_api_init_dirs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaApiImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [\"/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia\", \"/var/log/containers/octavia:/var/log/octavia:z\", \"/var/log/containers/httpd/octavia-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"mkdir -p /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /etc/octavia/conf.d/octavia-api; chown -R octavia:octavia /var/log/octavia\"]}}, \"step_3\": {\"octavia_db_sync\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"privileged\": false, \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia:/var/log/octavia:z\", \"/run/octavia:/run/octavia:shared,z\"], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"volumes\"]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"map_merge\": [{\"octavia_api\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia:/var/log/octavia:z\", \"/run/octavia:/run/octavia:shared,z\", \"/var/log/containers/httpd/octavia-api:/var/log/httpd:z\"], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\"], []]}, {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"], []]}, {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"volumes\"]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"if\": [\"enable_driver_agent\", {\"octavia_driver_agent\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaApiImage\"]}, \"net\": \"host\", \"privileged\": true, \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_driver_agent.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia:/var/log/octavia:z\", \"/run/octavia:/run/octavia:shared,z\"], {\"get_attr\": [\"OctaviaProviderConfig\", \"role_data\", \"volumes\"]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {}]}]}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/octavia\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/octavia-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/run/octavia\", \"setype\": \"container_file_t\", \"mode\": \"0755\"}]}, {\"name\": \"ensure /run/octavia is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-octavia.conf\", \"content\": \"d /run/octavia 0755 root root - -\\n\"}}], \"update_tasks\": {\"list_concat\": [{\"get_attr\": [\"OctaviaBase\", \"role_data\", \"update_tasks\"]}, [{\"name\": \"octavia_api_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"octavia_api_tmpfile_cleanup\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-octavia.conf\", \"state\": \"absent\"}}]}]]}, \"upgrade_tasks\": {\"list_concat\": [{\"get_attr\": [\"OctaviaBase\", \"role_data\", \"upgrade_tasks\"]}, [{\"name\": \"octavia_api_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"octavia_api_tmpfile_cleanup\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-octavia.conf\", \"state\": \"absent\"}}]}]]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop octavia api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"octavia_api\"], \"tripleo_delegate_to\": \"{{ groups['octavia_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-housekeeping-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Octavia service configured with Puppet\\n\", \"parameters\": {\"ContainerOctaviaHousekeepingImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOctaviaConfigImage\": {\"description\": \"The container image to use for the octavia config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"OctaviaHousekeepingLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.octavia.housekeeping\", \"file\": \"/var/log/containers/octavia/housekeeping.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"OctaviaAmphoraExpiryAge\": {\"default\": 0, \"description\": \"The interval in seconds after which an unused Amphora will be considered expired and cleaned up. If left to 0, the configuration will not be set and the system will use the service defaults.\", \"type\": \"number\"}, \"MonitoringSubscriptionOctaviaHousekeeping\": {\"default\": \"overcloud-octavia-housekeeping\", \"type\": \"string\"}}, \"conditions\": {\"amphora_expiry_is_zero\": {\"equals\": [{\"get_param\": \"OctaviaAmphoraExpiryAge\"}, 0]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"OctaviaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerOctaviaHousekeepingImage\": \"ContainerOctaviaHousekeepingImage\", \"ContainerOctaviaConfigImage\": \"ContainerOctaviaConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerOctaviaHousekeepingImage\": {\"get_param\": \"ContainerOctaviaHousekeepingImage\"}, \"ContainerOctaviaConfigImage\": {\"get_param\": \"ContainerOctaviaConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Octavia housekeeping role.\", \"value\": {\"service_name\": \"octavia_housekeeping\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionOctaviaHousekeeping\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"OctaviaBase\", \"role_data\", \"config_settings\"]}, {\"if\": [\"amphora_expiry_is_zero\", {}, {\"octavia::housekeeping::amphora_expiry_age\": {\"get_param\": \"OctaviaAmphoraExpiryAge\"}}]}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_octavia_housekeeping\": [{\"get_param\": \"OctaviaHousekeepingLoggingSource\"}]}}, \"puppet_config\": {\"config_volume\": \"octavia\", \"puppet_tags\": \"octavia_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::octavia::housekeeping\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/octavia_housekeeping.json\": {\"command\": \"/usr/bin/octavia-housekeeping --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --config-file /etc/octavia/post-deploy.conf --log-file /var/log/octavia/housekeeping.log --config-dir /etc/octavia/conf.d/octavia-housekeeping\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"octavia_housekeeping_init_dirs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaHousekeepingImage\"]}, \"user\": \"root\", \"net\": \"none\", \"volumes\": [\"/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z\"], \"command\": [\"/bin/bash\", \"-c\", \"mkdir -p /etc/octavia/conf.d/octavia-housekeeping; chown -R octavia:octavia /etc/octavia/conf.d/octavia-housekeeping\"]}}, \"step_5\": {\"octavia_housekeeping\": {\"start_order\": 2, \"stop_grace_period\": 630, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaHousekeepingImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_housekeeping.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia:/var/log/octavia:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"update_tasks\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"update_tasks\"]}, \"upgrade_tasks\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"upgrade_tasks\"]}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/octavia\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop octavia housekeeping container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"octavia_housekeeping\"], \"tripleo_delegate_to\": \"{{ groups['octavia_housekeeping'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-health-manager-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Octavia health-manager service configured with Puppet\\n\", \"parameters\": {\"ContainerOctaviaHealthManagerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOctaviaConfigImage\": {\"description\": \"The container image to use for the octavia config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerOctaviaRsyslogImage\": {\"description\": \"The container image to use for the rsyslog-sidecar\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"OctaviaHealthManagerLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.octavia.health-manager\", \"file\": \"/var/log/containers/octavia/health-manager.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionOctaviaHealthManager\": {\"default\": \"overcloud-octavia-health-manager\", \"type\": \"string\"}, \"OctaviaHeartbeatKey\": {\"type\": \"string\", \"description\": \"Key to identify heartbeat messages for amphorae.\", \"hidden\": true}, \"OctaviaMgmtPortDevName\": {\"type\": \"string\", \"default\": \"o-hm0\", \"description\": \"Name of the octavia management network interface using for communication between octavia worker/health-manager with the amphora machine.\"}, \"OctaviaLogOffload\": {\"default\": false, \"description\": \"When true, log messages from the amphora will be forwarded to the administrative log endponts and will be stored with the controller logs.\", \"type\": \"boolean\"}, \"OctaviaLogOffloadProtocol\": {\"default\": \"udp\", \"description\": \"The protocol to use for the RSyslog log offloading feature.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"udp\", \"tcp\"]}]}}, \"conditions\": {\"log_offload_enabled\": {\"equals\": [{\"get_param\": \"OctaviaLogOffload\"}, true]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"OctaviaBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerOctaviaHealthManagerImage\": \"ContainerOctaviaHealthManagerImage\", \"ContainerOctaviaConfigImage\": \"ContainerOctaviaConfigImage\", \"ContainerOctaviaRsyslogImage\": \"ContainerOctaviaRsyslogImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerOctaviaHealthManagerImage\": {\"get_param\": \"ContainerOctaviaHealthManagerImage\"}, \"ContainerOctaviaConfigImage\": {\"get_param\": \"ContainerOctaviaConfigImage\"}, \"ContainerOctaviaRsyslogImage\": {\"get_param\": \"ContainerOctaviaRsyslogImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Octavia health-manager role.\", \"value\": {\"service_name\": \"octavia_health_manager\", \"firewall_rules\": {\"200 octavia health manager interface\": {\"proto\": \"udp\", \"dport\": 5555, \"iniface\": {\"get_param\": \"OctaviaMgmtPortDevName\"}}, \"210 octavia lb-mgmt-net offload rsyslog\": {\"proto\": {\"get_param\": \"OctaviaLogOffloadProtocol\"}, \"dport\": 514, \"iniface\": {\"get_param\": \"OctaviaMgmtPortDevName\"}}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionOctaviaHealthManager\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"OctaviaBase\", \"role_data\", \"config_settings\"]}, {\"octavia::health_manager::heartbeat_key\": {\"get_param\": \"OctaviaHeartbeatKey\"}}]}, \"service_config_settings\": {\"rsyslog\": {\"tripleo_logging_sources_octavia_health_manager\": {\"list_concat\": [[{\"get_param\": \"OctaviaHealthManagerLoggingSource\"}], {\"if\": [{\"get_param\": \"OctaviaLogOffload\"}, [{\"tag\": \"openstack.octavia.amphora\", \"file\": \"/var/log/containers/octavia-amphorae/octavia-amphora.log\", \"startmsg.regex\": \"^[a-zA-Z]{3} [ 1-9][0-9] [:0-9]{8}\"}, {\"tag\": \"openstack.octavia.tenant\", \"file\": \"/var/log/containers/octavia-amphorae/octavia-tenant-traffic.log\", \"startmsg.regex\": \"^[a-zA-Z]{3} [ 1-9][0-9] [:0-9]{8}\"}]]}]}}}, \"puppet_config\": {\"config_volume\": \"octavia\", \"puppet_tags\": \"octavia_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::octavia::health_manager\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/octavia_health_manager.json\": {\"command\": \"/usr/bin/octavia-health-manager --config-file /usr/share/octavia/octavia-dist.conf --config-file /etc/octavia/octavia.conf --config-file /etc/octavia/post-deploy.conf --log-file /var/log/octavia/health-manager.log --config-dir /etc/octavia/conf.d/octavia-health-manager\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/octavia\", \"owner\": \"octavia:octavia\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/octavia_rsyslog.json\": {\"command\": \"/usr/sbin/rsyslogd -n -iNONE\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/octavia\", \"owner\": \"root:root\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"octavia_health_manager_init_dirs\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaHealthManagerImage\"]}, \"user\": \"root\", \"net\": \"none\", \"volumes\": [\"/var/lib/config-data/puppet-generated/octavia/etc/octavia:/etc/octavia:z\"], \"command\": [\"/bin/bash\", \"-c\", \"mkdir -p /etc/octavia/conf.d/octavia-health-manager; chown -R octavia:octavia /etc/octavia/conf.d/octavia-health-manager\"]}}, \"step_5\": {\"map_merge\": [{\"octavia_health_manager\": {\"start_order\": 2, \"stop_grace_period\": 630, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaHealthManagerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_health_manager.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia:/var/log/octavia:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"if\": [\"log_offload_enabled\", {\"octavia_rsyslog\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerOctaviaRsyslogImage\"]}, \"net\": \"host\", \"privileged\": true, \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/octavia_rsyslog.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/octavia:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/octavia-amphorae:/var/log/octavia:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {}]}]}}, \"update_tasks\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"update_tasks\"]}, \"upgrade_tasks\": {\"get_attr\": [\"OctaviaBase\", \"role_data\", \"upgrade_tasks\"]}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/octavia\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/octavia-amphorae\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"create empty log files\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"touch\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/octavia-amphorae/octavia-tenant-traffic.log\", \"setype\": \"container_file_t\", \"mode\": \"0644\"}, {\"path\": \"/var/log/containers/octavia-amphorae/octavia-amphora.log\", \"setype\": \"container_file_t\", \"mode\": \"0644\"}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop octavia health manager container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"octavia_health_manager\"], \"tripleo_delegate_to\": \"{{ groups['octavia_health_manager'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/octavia/octavia-deployment-config.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Configuration of Octavia as-a-service resources in the overcloud.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"OctaviaPostWorkflowName\": {\"description\": \"Mistral workflow name for octavia configuration steps once the overcloud is ready.\", \"type\": \"string\", \"default\": \"tripleo.octavia_post.v1.octavia_post_deploy\"}, \"OctaviaAmphoraImageName\": {\"description\": \"The glance image name used when spawning amphorae. Default is an empty string which will use the file name as the image name.\", \"type\": \"string\", \"default\": \"\"}, \"OctaviaAmphoraImageFilename\": {\"description\": \"Filename for the amphora image. Image files are expected to be located in directory /usr/share/openstack-octavia-amphora-images. Using the default of an empty string will cause a distro specific default to be used. (e.g. /usr/share/openstack-octavia-amphora-images/amphora-x64-haproxy.qcow2 on CentOS and /usr/share/openstack-octavia-amphora-images/octavia-amphora.qcow2 on Red Hat Enterprise Linux).\", \"type\": \"string\", \"default\": \"\"}, \"OctaviaAmphoraImageFormat\": {\"default\": \"qcow2\", \"description\": \"Image format ('qcow2' or 'raw') of the amphora image.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"qcow2\", \"raw\"]}]}, \"OctaviaAmphoraImageTag\": {\"default\": \"amphora-image\", \"description\": \"Glance image tag for identifying the amphora image.\", \"type\": \"string\"}, \"OctaviaAmphoraImageArchitecture\": {\"default\": \"x86_64\", \"description\": \"Architecture of the amphora image.\", \"type\": \"string\"}, \"OctaviaAmphoraSshKeyName\": {\"type\": \"string\", \"default\": \"octavia-ssh-key\", \"description\": \"SSH key name.\"}, \"OctaviaAmphoraSshKeyFile\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Public key file path. User will be able to SSH into amphorae with the provided key. User may, in most cases, also elevate to root from user 'centos' (CentOS), 'ubuntu' (Ubuntu) or 'cloud-user' (RHEL) (depends on how amphora image was created). Logging in to amphorae provides a convenient way to e.g. debug load balancing services.\"}, \"OctaviaAmphoraSshKeyDir\": {\"type\": \"string\", \"default\": \"/etc/octavia/ssh\", \"description\": \"Octavia generated SSH key directory.\"}, \"NovaEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable the Rbd backend for Nova ephemeral storage.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"OctaviaControlNetwork\": {\"description\": \"The name for the neutron network used for the amphora control network\", \"type\": \"string\", \"default\": \"lb-mgmt-net\"}, \"OctaviaControlSubnet\": {\"description\": \"The name for the neutron subnet used for the amphora control network\", \"type\": \"string\", \"default\": \"lb-mgmt-subnet\"}, \"OctaviaControlSecurityGroup\": {\"description\": \"The name for the neutron security group used to control access on the amphora control network\", \"type\": \"string\", \"default\": \"lb-mgmt-sec-group\"}, \"OctaviaControlSubnetCidr\": {\"description\": \"Subnet for amphora control subnet in CIDR form.\", \"type\": \"string\", \"default\": \"172.24.0.0/16\"}, \"OctaviaControlSubnetGateway\": {\"description\": \"IP address for control network gateway\", \"type\": \"string\", \"default\": \"172.24.0.1\"}, \"OctaviaControlSubnetPoolStart\": {\"description\": \"First address in amphora control subnet address pool.\", \"type\": \"string\", \"default\": \"172.24.0.2\"}, \"OctaviaControlSubnetPoolEnd\": {\"description\": \"First address in amphora control subnet address pool.\", \"type\": \"string\", \"default\": \"172.24.255.254\"}, \"OctaviaCaCertFile\": {\"type\": \"string\", \"default\": \"/etc/octavia/certs/ca_01.pem\", \"description\": \"Octavia CA certificate file path.\"}, \"OctaviaCaKeyFile\": {\"type\": \"string\", \"default\": \"/etc/octavia/certs/private/cakey.pem\", \"description\": \"Octavia CA private key file path.\"}, \"OctaviaServerCertsKeyPassphrase\": {\"constraints\": [{\"length\": {\"min\": 32, \"max\": 32}}], \"description\": \"Passphrase for encrypting Amphora Certificates and Private Keys. Must be exactly 32 characters.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaCaKeyPassphrase\": {\"description\": \"CA private key passphrase.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaClientCertFile\": {\"default\": \"/etc/octavia/certs/client.pem\", \"description\": \"Octavia client certificate for amphorae.\", \"type\": \"string\"}, \"OctaviaGenerateCerts\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Enable internal generation of certificates for secure communication with amphorae for isolated private clouds or systems where security is not a concern. Otherwise, use OctaviaCaCert, OctaviaCaKey, OctaviaCaKeyPassphrase, OctaviaClientCert and OctaviaServerCertsKeyPassphrase to configure Octavia.\"}, \"OctaviaMgmtPortDevName\": {\"type\": \"string\", \"default\": \"o-hm0\", \"description\": \"Name of the octavia management network interface using for communication between octavia worker/health-manager with the amphora machine.\"}, \"AdminPassword\": {\"description\": \"The password for the keystone admin account, used for monitoring, querying neutron etc.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaUserName\": {\"description\": \"The username for the Octavia database and keystone accounts.\", \"type\": \"string\", \"default\": \"octavia\"}, \"OctaviaPassword\": {\"description\": \"The password for the Octavia database and keystone accounts.\", \"type\": \"string\", \"hidden\": true}, \"OctaviaProjectName\": {\"description\": \"The project name for the keystone Octavia account.\", \"type\": \"string\", \"default\": \"service\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"OctaviaLogOffload\": {\"default\": false, \"description\": \"When true, log messages from the amphora will be forwarded to the administrative log endponts and will be stored with the controller logs.\", \"type\": \"boolean\"}, \"OctaviaLogOffloadProtocol\": {\"default\": \"udp\", \"description\": \"The protocol to use for the RSyslog log offloading feature.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"udp\", \"tcp\"]}]}, \"OctaviaFlavorId\": {\"default\": \"65\", \"description\": \"Nova flavor ID to be used when creating the nova flavor for amphora.\", \"type\": \"string\"}, \"OctaviaFlavorProperties\": {\"default\": {\"ram\": \"1024\", \"disk\": \"3\", \"vcpus\": \"1\"}, \"description\": \"Dictionary describing the nova flavor for amphora.\", \"type\": \"json\"}, \"OctaviaManageNovaFlavor\": {\"default\": true, \"description\": \"Configure the nova flavor for the amphora.\", \"type\": \"boolean\"}, \"OctaviaMultiVcpuFlavorProperties\": {\"default\": {\"ram\": \"4096\", \"disk\": \"3\", \"vcpus\": \"4\"}, \"description\": \"Dictionary describing the nova flavor for amphora with active-standby topology and multiple vCPUs for vertical scaling.\", \"type\": \"json\"}, \"OctaviaMultiVcpuFlavorId\": {\"default\": \"amphora-mvcpu-ha\", \"description\": \"Name of the nova flavor for the amphora with multiple vCPUs.\", \"type\": \"string\"}, \"OctaviaAdminLogTargets\": {\"default\": [], \"description\": \"List of syslog endpoints, host:port comma separated list, to receive administrative log messages.\", \"type\": \"comma_delimited_list\"}, \"OctaviaTenantLogTargets\": {\"default\": [], \"description\": \"List of syslog endpoints, host:port comma separated list, to receive tenant traffic flow log messages.\", \"type\": \"comma_delimited_list\"}}, \"conditions\": {\"octavia_raw_image_check\": {\"or\": [{\"equals\": [{\"get_param\": \"OctaviaAmphoraImageFormat\"}, \"raw\"]}, {\"get_param\": \"NovaEnableRbdBackend\"}]}}, \"resources\": {\"OctaviaVars\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"vars\": {\"os_auth_type\": \"password\", \"os_identity_api_version\": \"3\", \"amp_image_name\": {\"get_param\": \"OctaviaAmphoraImageName\"}, \"amp_image_filename\": {\"get_param\": \"OctaviaAmphoraImageFilename\"}, \"amp_image_tag\": {\"get_param\": \"OctaviaAmphoraImageTag\"}, \"amp_hw_arch\": {\"get_param\": \"OctaviaAmphoraImageArchitecture\"}, \"amp_ssh_key_name\": {\"get_param\": \"OctaviaAmphoraSshKeyName\"}, \"amp_ssh_key_path\": {\"get_param\": \"OctaviaAmphoraSshKeyFile\"}, \"amp_ssh_key_dir\": {\"get_param\": \"OctaviaAmphoraSshKeyDir\"}, \"amp_to_raw\": {\"if\": [\"octavia_raw_image_check\", true, false]}, \"auth_username\": {\"get_param\": \"OctaviaUserName\"}, \"auth_password\": {\"get_param\": \"OctaviaPassword\"}, \"auth_project_name\": {\"get_param\": \"OctaviaProjectName\"}, \"lb_mgmt_net_name\": {\"get_param\": \"OctaviaControlNetwork\"}, \"lb_mgmt_subnet_name\": {\"get_param\": \"OctaviaControlSubnet\"}, \"lb_sec_group_name\": {\"get_param\": \"OctaviaControlSubnet\"}, \"lb_mgmt_subnet_cidr\": {\"get_param\": \"OctaviaControlSubnetCidr\"}, \"lb_mgmt_subnet_gateway\": {\"get_param\": \"OctaviaControlSubnetGateway\"}, \"lb_mgmt_subnet_pool_start\": {\"get_param\": \"OctaviaControlSubnetPoolStart\"}, \"lb_mgmt_subnet_pool_end\": {\"get_param\": \"OctaviaControlSubnetPoolEnd\"}, \"ca_cert_path\": {\"get_param\": \"OctaviaCaCertFile\"}, \"ca_private_key_path\": {\"get_param\": \"OctaviaCaKeyFile\"}, \"server_certs_key_passphrase\": {\"get_param\": \"OctaviaServerCertsKeyPassphrase\"}, \"ca_passphrase\": {\"get_param\": \"OctaviaCaKeyPassphrase\"}, \"client_cert_path\": {\"get_param\": \"OctaviaClientCertFile\"}, \"generate_certs\": {\"get_param\": \"OctaviaGenerateCerts\"}, \"mgmt_port_dev\": {\"get_param\": \"OctaviaMgmtPortDevName\"}, \"os_password\": {\"get_param\": \"AdminPassword\"}, \"os_project_name\": \"admin\", \"os_username\": \"admin\", \"octavia_ansible_playbook\": \"/usr/share/ansible/tripleo-playbooks/octavia-files.yaml\", \"os_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Public\", \"uri\"]}, \"os_int_auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri\"]}, \"octavia_local_tmpdir\": \"{{playbook_dir}}/octavia-ansible/local_dir\", \"octavia_group_vars_dir\": \"{{playbook_dir}}/octavia-ansible/group_vars\", \"container_cli\": {\"get_param\": \"ContainerCli\"}, \"enable_log_offloading\": {\"get_param\": \"OctaviaLogOffload\"}, \"log_offload_protocol\": {\"get_param\": \"OctaviaLogOffloadProtocol\"}, \"octavia_flavor_id\": {\"get_param\": \"OctaviaFlavorId\"}, \"octavia_flavor_properties\": {\"get_param\": \"OctaviaFlavorProperties\"}, \"octavia_manage_nova_flavor\": {\"get_param\": \"OctaviaManageNovaFlavor\"}, \"octavia_multivcpu_flavor_properties\": {\"get_param\": \"OctaviaMultiVcpuFlavorProperties\"}, \"octavia_multivcpu_flavor_id\": {\"get_param\": \"OctaviaMultiVcpuFlavorId\"}, \"octavia_admin_log_targets\": {\"get_param\": \"OctaviaAdminLogTargets\"}, \"octavia_tenant_log_targets\": {\"get_param\": \"OctaviaTenantLogTargets\"}}}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Octavia configuration service\", \"value\": {\"service_name\": \"octavia_deployment_config\", \"upgrade_tasks\": [], \"puppet_config\": {}, \"docker_config\": {}, \"config_settings\": {}, \"external_post_deploy_tasks\": [{\"name\": \"octavia_post_deploy\", \"block\": [{\"name\": \"Set up group_vars\", \"set_fact\": {\"octavia_ansible_group_vars\": {\"get_attr\": [\"OctaviaVars\", \"value\", \"vars\"]}}, \"no_log\": \"{{ hide_sensitive_logs | bool }}\"}, {\"name\": \"Make needed directories on the undercloud\", \"become\": true, \"file\": {\"path\": \"{{item}}\", \"state\": \"directory\", \"owner\": \"{{ ansible_user }}\"}, \"with_items\": [\"{{playbook_dir}}/octavia-ansible\", \"{{ octavia_ansible_group_vars.octavia_local_tmpdir }}\", \"{{ octavia_ansible_group_vars.octavia_group_vars_dir }}\"]}, {\"name\": \"Write group_vars file\", \"become\": true, \"copy\": {\"dest\": \"{{ octavia_ansible_group_vars.octavia_group_vars_dir }}/octavia_vars.yaml\", \"content\": \"{{ octavia_ansible_group_vars|to_nice_yaml }}\"}, \"no_log\": \"{{ hide_sensitive_logs | bool }}\"}, {\"name\": \"Gather missing facts\", \"delegate_to\": \"{{item}}\", \"delegate_facts\": true, \"loop\": \"{{ groups['octavia_worker'] }}\", \"setup\": {\"gather_subset\": [\"!all\", \"min\"]}}, {\"name\": \"Write octavia inventory\", \"become\": true, \"copy\": {\"dest\": \"{{playbook_dir}}/octavia-ansible/inventory.yaml\", \"content\": \"octavia_nodes:\\n  hosts:\\n\\n{%- set octavia_groups = ['worker'] -%}\\n{%- for octavia_group in octavia_groups -%}\\n{%- if 'octavia_' ~ octavia_groups %}\\n\\n    {% for host in groups['octavia_' ~ octavia_group] -%}\\n    {{ hostvars.raw_get(host)['ansible_facts']['hostname'] | lower}}:\\n      ansible_user: {{ hostvars.raw_get(host)['ansible_ssh_user'] | default('heat-admin') }}\\n      ansible_host: {{ hostvars.raw_get(host)['ansible_host'] | default(host) | lower }}\\n      canonical_hostname: {{ hostvars.raw_get(host)['canonical_hostname'] | default(host) | lower }}\\n      ansible_become: true\\n    {% endfor %}\\n\\n{%- endif -%}\\n{%- endfor %}\\n\\nUndercloud:\\n  hosts:\\n    {% for host in groups['Undercloud'] -%}\\n    {{ hostvars.raw_get(host)['ansible_facts']['hostname'] | lower}}:\\n      ansible_host: {{ hostvars.raw_get(host)['ansible_host'] | default(host) | lower }}\\n      ansible_become: false\\n      ansible_connection: local\\n\\n    {%- endfor -%}\\n\"}}, {\"name\": \"Check for ssh_private_key in working directory\", \"become\": true, \"stat\": {\"path\": \"{{ lookup('env', 'ANSIBLE_PRIVATE_KEY_FILE') }}\"}, \"register\": \"detect_private_key_file\"}, {\"name\": \"Set private key location\", \"set_fact\": {\"octavia_ansible_ssh_key\": \"{{ lookup('env', 'ANSIBLE_PRIVATE_KEY_FILE') }}\"}, \"when\": \"octavia_ansible_ssh_key is not defined and detect_private_key_file.stat.exists\"}, {\"name\": \"Configure octavia command\", \"set_fact\": {\"config_octavia_cmd\": {\"list_join\": [\" \", [\"ANSIBLE_CONFIG=\\\"{{playbook_dir}}/ansible.cfg\\\" ansible-playbook -i \\\"{{playbook_dir}}/octavia-ansible/inventory.yaml\\\"\", \"--extra-vars @{{ octavia_ansible_group_vars.octavia_group_vars_dir }}/octavia_vars.yaml\", \"{% if octavia_ansible_ssh_key is defined %}--private-key {{octavia_ansible_ssh_key}}{% endif %}\", \"{{ octavia_ansible_group_vars.octavia_ansible_playbook }}\"]]}}}, {\"set_fact\": {\"octavia_log_dir\": \"{{playbook_dir}}/octavia-ansible/\"}}, {\"debug\": {\"msg\": \"Configure Octavia command is: {{ config_octavia_cmd }}\"}}, {\"name\": \"Configure octavia on overcloud\", \"become\": true, \"environment\": {\"ANSIBLE_HOST_KEY_CHECKING\": false, \"ANSIBLE_SSH_RETRIES\": 3, \"ANSIBLE_RETRY_FILES_ENABLED\": false, \"ANSIBLE_LOCAL_TEMP\": \"{{ octavia_ansible_group_vars.octavia_local_tmpdir }}\", \"ANSIBLE_LOG_PATH\": \"{{ octavia_log_dir }}/octavia-ansible.log\"}, \"shell\": \"{{ config_octavia_cmd }}\"}, {\"name\": \"Purge temp dirs\", \"become\": true, \"file\": {\"state\": \"absent\", \"path\": \"{{ item }}\"}, \"with_items\": [\"{{ octavia_ansible_group_vars.octavia_local_tmpdir }}\"]}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/database/redis-base-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Redis service configured with Puppet\\n\", \"parameters\": {\"RootStackName\": {\"description\": \"The name of the stack/plan.\", \"type\": \"string\"}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}, \"RedisFDLimit\": {\"description\": \"Configure Redis FD limit\", \"type\": \"number\", \"default\": 10240}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"RedisIPv6\": {\"default\": false, \"description\": \"Enable IPv6 in Redis\", \"type\": \"boolean\"}, \"RedisVirtualFixedIPs\": {\"default\": [], \"description\": \"Control the IP allocation for the virtual IP used by Redis. E.g. [{'ip_address':'1.2.3.4'}]\\n\", \"type\": \"json\"}, \"ServiceVips\": {\"default\": {}, \"type\": \"json\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"RedisIPv6\"]}], \"conditions\": {\"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}]}, 6]}, \"redis_virtual_fixed_ip_set\": {\"not\": {\"equals\": [{\"get_param\": \"RedisVirtualFixedIPs\"}, []]}}, \"redis_service_vip_set\": {\"not\": {\"equals\": [{\"get_param\": [\"ServiceVips\", \"redis\"]}, \"\"]}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the redis role.\", \"value\": {\"service_name\": \"redis_base\", \"config_settings\": {\"redis::requirepass\": {\"get_param\": \"RedisPassword\"}, \"redis::masterauth\": {\"get_param\": \"RedisPassword\"}, \"redis::sentinel_auth_pass\": {\"get_param\": \"RedisPassword\"}, \"redis_ipv6\": {\"if\": [\"is_ipv6\", true, false]}, \"redis::bind\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"if\": [\"is_ipv6\", \"::1\", \"127.0.0.1\"]}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}]}, \"redis::port\": 6379, \"redis::sentinel::master_name\": \"%{hiera('redis_short_bootstrap_node_name')}\", \"redis::sentinel::redis_host\": \"%{hiera('redis_bootstrap_node_ip')}\", \"redis::sentinel::notification_script\": \"/usr/local/bin/redis-notifications.sh\", \"redis::sentinel::sentinel_bind\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"if\": [\"is_ipv6\", \"::1\", \"127.0.0.1\"]}, {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}]}, \"redis::ulimit\": {\"get_param\": \"RedisFDLimit\"}}, \"external_deploy_tasks\": [{\"when\": [\"step|int == 0\"], \"name\": \"redis_external_deploy_init\", \"block\": [{\"name\": \"create redis virtual ip\", \"tripleo_service_vip\": {\"playbook_dir\": \"{{ playbook_dir }}\", \"stack_name\": {\"get_param\": \"RootStackName\"}, \"service_name\": \"redis\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}, \"fixed_ips\": {\"if\": [\"redis_virtual_fixed_ip_set\", {\"get_param\": \"RedisVirtualFixedIPs\"}, {\"if\": [\"redis_service_vip_set\", [{\"ip_address\": {\"get_param\": [\"ServiceVips\", \"redis\"]}}], [{\"subnet\": {\"get_param\": [\"ServiceData\", \"vip_subnet_map\", \"redis\"]}}]]}]}}}]}], \"external_update_tasks\": [{\"when\": [\"step|int == 0\"], \"name\": \"redis_external_update_init\", \"block\": [{\"name\": \"create redis virtual ip\", \"tripleo_service_vip\": {\"playbook_dir\": \"{{ playbook_dir }}\", \"stack_name\": {\"get_param\": \"RootStackName\"}, \"service_name\": \"redis\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}, \"fixed_ips\": {\"if\": [\"redis_virtual_fixed_ip_set\", {\"get_param\": \"RedisVirtualFixedIPs\"}, {\"if\": [\"redis_service_vip_set\", [{\"ip_address\": {\"get_param\": [\"ServiceVips\", \"redis\"]}}], [{\"subnet\": {\"get_param\": [\"ServiceData\", \"vip_subnet_map\", \"redis\"]}}]]}]}}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/database/redis-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Redis services\\n\", \"parameters\": {\"ContainerRedisImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerRedisConfigImage\": {\"description\": \"The container image to use for the redis config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"RedisCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"conditions\": {\"key_size_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"RedisCertificateKeySize\"}, \"\"]}}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RedisBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/redis-base-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerRedisImage\": \"ContainerRedisImage\", \"ContainerRedisConfigImage\": \"ContainerRedisConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerRedisImage\": {\"get_param\": \"ContainerRedisImage\"}, \"ContainerRedisConfigImage\": {\"get_param\": \"ContainerRedisConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Redis API role.\", \"value\": {\"service_name\": \"redis\", \"firewall_rules\": {\"108 redis\": {\"dport\": [6379, 26379]}}, \"firewall_frontend_rules\": {\"100 redis_haproxy_frontend\": {\"dport\": [6379, 26379]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"RedisBase\", \"role_data\", \"config_settings\"]}, {\"redis::daemonize\": false, \"tripleo::stunnel::manage_service\": false, \"tripleo::stunnel::foreground\": \"yes\"}, {\"tripleo::profile::base::database::redis::tls_proxy_bind_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"tripleo::profile::base::database::redis::tls_proxy_fqdn\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"tripleo::profile::base::database::redis::tls_proxy_port\": 6379}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"tripleo::redis::service_certificate\": \"/etc/pki/tls/certs/redis.crt\", \"redis_certificate_specs\": {\"service_certificate\": \"/etc/pki/tls/certs/redis.crt\", \"service_key\": \"/etc/pki/tls/private/redis.key\"}}]}]}, \"service_config_settings\": {\"get_attr\": [\"RedisBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"redis\", \"puppet_tags\": \"exec\", \"step_config\": {\"list_join\": [\"\\n\", [\"Exec <| title == 'systemd-reload-redis' |> { unless => 'true' }\", \"include tripleo::profile::base::database::redis\", {\"get_attr\": [\"RedisBase\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/redis.json\": {\"command\": \"/usr/bin/redis-server /etc/redis.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/run/redis\", \"owner\": \"redis:redis\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/redis_tls_proxy.json\": {\"command\": \"stunnel /etc/stunnel/stunnel.conf\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_1\": {\"map_merge\": [{\"redis_init_logs\": {\"start_order\": 0, \"detach\": false, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"net\": \"none\", \"privileged\": false, \"user\": \"root\", \"volumes\": [\"/var/log/containers/redis:/var/log/redis:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R redis:redis /var/log/redis\"]}}, {\"redis\": {\"start_order\": 1, \"stop_grace_period\": 60, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": [\"/var/lib/kolla/config_files/redis.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/redis:/var/lib/kolla/config_files/src:ro\", \"/etc/localtime:/etc/localtime:ro\", \"/var/log/containers/redis:/var/log/redis:z\", \"/run/redis:/run/redis:z\"], \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"redis_tls_proxy\": {\"start_order\": 2, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/redis_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/redis:/var/lib/kolla/config_files/src:ro\", \"/etc/pki/tls/certs/redis.crt:/etc/pki/tls/certs/redis.crt:ro\", \"/etc/pki/tls/private/redis.key:/etc/pki/tls/private/redis.key:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}]}}, \"metadata_settings\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [{\"service\": \"redis\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}, \"type\": \"vip\"}, {\"service\": \"redis\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}, \"type\": \"node\"}]]}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"redis\", \"dns\": [{\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, {\"str_replace\": {\"template\": \"{{cloud_names.cloud_name_NETWORK}}\", \"params\": {\"NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}], \"principal\": {\"str_replace\": {\"template\": \"redis/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"run_after\": \"container_name=$({{container_cli}} ps --format=\\\\{\\\\{.Names\\\\}\\\\} | grep redis_tls_proxy)\\nservice_crt=\\\"/etc/pki/tls/certs/redis.crt\\\"\\nservice_key=\\\"/etc/pki/tls/private/redis.key\\\"\\n# Copy the new cert from the mount-point to the real path\\n{{container_cli}} exec \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_crt\\\" \\\"$service_crt\\\"\\n# Copy the new cert from the mount-point to the real path\\n{{container_cli}} exec \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_key\\\" \\\"$service_key\\\"\\n# Set appropriate permissions\\n{{container_cli}} exec \\\"$container_name\\\" chown memcached:memcached \\\"$service_crt\\\"\\n{{container_cli}} exec \\\"$container_name\\\" chown memcached:memcached \\\"$service_key\\\"\\n# Trigger a reload for stunnel to read the new certificate\\n{{container_cli}} exec pkill -o -HUP stunnel\\n\", \"key_size\": {\"if\": [\"key_size_override_set\", {\"get_param\": \"RedisCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], \"external_deploy_tasks\": {\"get_attr\": [\"RedisBase\", \"role_data\", \"external_deploy_tasks\"]}, \"host_prep_tasks\": [{\"name\": \"create fcontext entry for redis data\", \"community.general.sefcontext\": {\"target\": \"/var/run/redis(/.*)?\", \"setype\": \"container_file_t\", \"state\": \"present\"}}, {\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/redis\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/run/redis\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure /run/redis is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-redis.conf\", \"content\": \"d /run/redis 0755 root root - -\\n\"}}], \"update_tasks\": [{\"name\": \"redis_container_puppet_redis_pkg_clean\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Ensure redis is uninstalled on container host\", \"package\": {\"name\": \"redis\", \"state\": \"absent\"}}]}, {\"name\": \"redis_container_puppet_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-redis.conf\", \"state\": \"absent\"}}]}], \"external_update_tasks\": {\"get_attr\": [\"RedisBase\", \"role_data\", \"external_update_tasks\"]}, \"upgrade_tasks\": [{\"name\": \"redis_container_puppet_redis_pkg_clean\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Ensure redis is uninstalled on container host\", \"package\": {\"name\": \"redis\", \"state\": \"absent\"}}]}, {\"name\": \"redis_container_puppet_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"remove old tmpfiles.d config\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-redis.conf\", \"state\": \"absent\"}}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop redis container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": {\"with_items\": {\"list_concat\": [[\"redis\"], [{\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"redis_tls_proxy\"]]}]]}}, \"tripleo_delegate_to\": \"{{ groups['redis'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/database/redis-pacemaker-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Redis services\\n\", \"parameters\": {\"ContainerRedisImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerRedisConfigImage\": {\"description\": \"The container image to use for the redis config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ClusterCommonTag\": {\"default\": false, \"description\": \"When set to false, a pacemaker service is configured to use a floating tag for its container image name, e.g. 'REGISTRY/NAMESPACE/IMAGENAME:pcmklatest'. When set to true, the service uses a floating prefix as well, e.g. 'cluster.common.tag/IMAGENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"ClusterFullTag\": {\"default\": true, \"description\": \"When set to true, the pacemaker service uses a fully constant tag for its container image name, e.g. 'cluster.common.tag/SERVICENAME:pcmklatest'.\", \"type\": \"boolean\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"ConfigDebug\": {\"default\": false, \"description\": \"Whether to run config management (e.g. Puppet) in debug mode.\", \"type\": \"boolean\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"RedisIPv6\": {\"default\": false, \"description\": \"Enable IPv6 in Redis\", \"type\": \"boolean\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"RedisIPv6\"]}], \"conditions\": {\"is_ipv6\": {\"equals\": [{\"get_param\": [\"ServiceData\", \"net_ip_version_map\", {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}]}, 6]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"RedisBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/redis-container-puppet.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerRedisImage\": \"ContainerRedisImage\", \"ContainerRedisConfigImage\": \"ContainerRedisConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerRedisImage\": {\"get_param\": \"ContainerRedisImage\"}, \"ContainerRedisConfigImage\": {\"get_param\": \"ContainerRedisConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Redis API role.\", \"value\": {\"service_name\": \"redis\", \"firewall_rules\": {\"108 redis-bundle\": {\"dport\": [3124, 6379, 26379]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"RedisBase\", \"role_data\", \"config_settings\"]}, {\"redis::service_manage\": false, \"redis::notify_service\": false, \"redis::managed_by_cluster_manager\": true, \"tripleo::profile::pacemaker::database::redis_bundle::redis_docker_image\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/redis:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"tripleo::profile::pacemaker::database::redis_bundle::control_port\": 3124, \"tripleo::profile::pacemaker::database::redis_bundle::container_backend\": {\"get_param\": \"ContainerCli\"}, \"tripleo::profile::pacemaker::database::redis_bundle::force_ocf\": true, \"tripleo::stunnel::manage_service\": false, \"tripleo::stunnel::foreground\": \"yes\", \"tripleo::profile::pacemaker::database::redis_bundle::tls_proxy_bind_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::redis_bundle::tls_proxy_fqdn\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::redis_bundle::tls_proxy_port\": 6379, \"tripleo::profile::pacemaker::database::redis::tls_proxy_bind_ip\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::redis::tls_proxy_fqdn\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"tripleo::profile::pacemaker::database::redis::tls_proxy_port\": 6379}, {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"redis::extra_config_file\": \"/etc/redis-tls.conf\", \"tripleo::profile::pacemaker::database::redis_bundle::extra_config_file\": \"/etc/redis-tls.conf\", \"tripleo::profile::pacemaker::database::redis_bundle::tls_tunnel_base_port\": 6660, \"tripleo::profile::pacemaker::database::redis_bundle::tls_tunnel_local_name\": {\"if\": [\"is_ipv6\", \"::1\", \"127.0.0.1\"]}}]}]}, \"service_config_settings\": {\"get_attr\": [\"RedisBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"redis\", \"puppet_tags\": \"exec\", \"step_config\": \"Exec <| title == 'systemd-reload-redis' |> { unless => 'true' }\\ninclude tripleo::profile::pacemaker::database::redis_bundle\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/redis.json\": {\"command\": \"/usr/sbin/pacemaker_remoted\", \"config_files\": [{\"dest\": \"/etc/libqb/force-filesystem-sockets\", \"source\": \"/dev/null\", \"owner\": \"root\", \"perm\": \"0644\"}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/run/redis\", \"owner\": \"redis:redis\", \"recurse\": true}, {\"path\": \"/var/lib/redis\", \"owner\": \"redis:redis\", \"recurse\": true}, {\"path\": \"/var/log/redis\", \"owner\": \"redis:redis\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/redis_tls_proxy.json\": {\"command\": {\"str_replace\": {\"template\": \"bash -c $* -- eval /wait-port-and-run.sh $(hiera fqdn_$NETWORK) 6379 stunnel /etc/stunnel/stunnel.conf\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"RedisNetwork\"]}}}}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"optional\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/etc/pki/tls/certs/redis.crt\", \"owner\": \"root:root\", \"perm\": \"0600\", \"optional\": true}, {\"path\": \"/etc/pki/tls/private/redis.key\", \"owner\": \"root:root\", \"perm\": \"0600\", \"optional\": true}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_1\": {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, {\"redis_tls_proxy\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"net\": \"host\", \"user\": \"root\", \"restart\": \"always\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/redis_tls_proxy.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/redis:/var/lib/kolla/config_files/src:ro\", \"/etc/pki/tls/certs/redis.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/redis.crt:ro\", \"/etc/pki/tls/private/redis.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/redis.key:ro\", \"/var/lib/container-config-scripts/wait-port-and-run.sh:/wait-port-and-run.sh:ro\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}}, \"metadata_settings\": {\"get_attr\": [\"RedisBase\", \"role_data\", \"metadata_settings\"]}, \"external_deploy_tasks\": {\"get_attr\": [\"RedisBase\", \"role_data\", \"external_deploy_tasks\"]}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/lib/redis\", \"setype\": \"container_file_t\"}, {\"path\": \"/var/log/containers/redis\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/run/redis\", \"setype\": \"container_file_t\"}]}, {\"name\": \"ensure /run/redis is present upon reboot\", \"copy\": {\"dest\": \"/etc/tmpfiles.d/run-redis.conf\", \"content\": \"d /run/redis 0755 root root - -\\n\"}}], \"deploy_steps_tasks\": {\"list_concat\": [{\"get_attr\": [\"RedisBase\", \"role_data\", \"deploy_steps_tasks\"]}, [{\"name\": \"Redis tag container image for pacemaker\", \"when\": \"step|int == 1\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"container_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/redis:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}}}, {\"name\": \"Redis HA Wrappers Step\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Redis puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"redis\", \"tripleo_ha_wrapper_resource_name\": \"redis\", \"tripleo_ha_wrapper_bundle_name\": \"redis-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Slave Master\", \"tripleo_ha_wrapper_puppet_config_volume\": \"redis\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::database::redis_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}]}]]}, \"external_update_tasks\": {\"list_concat\": [{\"get_attr\": [\"RedisBase\", \"role_data\", \"external_update_tasks\"]}, [{\"when\": \"step|int == 1\", \"tags\": \"ha_image_update\", \"block\": [{\"block\": [{\"name\": \"Get redis image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_redis_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='redis-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container redis image\", \"set_fact\": {\"redis_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"redis_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/redis:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_redis_image\": \"{{xmllint_pcmk_redis_image.stdout}}\"}}], \"delegate_to\": \"{{ (groups[\\\"redis\\\"] | difference(groups[\\\"excluded_overcloud\\\"]))[0] }}\"}, {\"name\": \"redis temporary pacemaker container tag in case of image switch\", \"become\": true, \"import_role\": {\"name\": \"tripleo_ha_image_update\"}, \"vars\": {\"tripleo_ha_image_update_node_names\": \"{{ groups[\\\"redis\\\"] | difference(groups[\\\"excluded_overcloud\\\"]) }}\", \"tripleo_ha_image_update_bundle\": \"redis-bundle\", \"tripleo_ha_image_update_new_image\": \"{{redis_image_latest}}\", \"tripleo_ha_image_update_old_image\": \"{{pcmk_redis_image}}\"}, \"when\": [\"(pcmk_redis_image != \\\"\\\")\", \"(pcmk_redis_image != redis_image_latest)\"]}]}]]}, \"update_tasks\": [{\"block\": [{\"name\": \"Get redis image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_redis_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='redis-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container redis image\", \"set_fact\": {\"redis_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"redis_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/redis:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_redis_image\": \"{{xmllint_pcmk_redis_image.stdout}}\"}}], \"when\": \"(step|int == 0 or step|int == 2)\"}, {\"name\": \"Check for update of redis container image name\", \"when\": \"step|int == 0\", \"assert\": {\"that\": \"pcmk_redis_image == redis_image_latest\", \"fail_msg\": \"redis image change detected, run overcloud external-update --tags ha_image_update first\"}}, {\"name\": \"redis_pacemaker_puppet_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Clean old tmpfile configuration\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-redis.conf\", \"state\": \"absent\"}}]}, {\"name\": \"Tear-down non-HA redis container\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Remove non-HA redis container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"redis\"]}}]}, {\"name\": \"Redis fetch and retag container image for pacemaker\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Retag pcmklatest to latest redis image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{redis_image}}\", \"container_image_latest\": \"{{redis_image_latest}}\"}}]}], \"post_update_tasks\": [{\"name\": \"Redis bundle post update\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Redis puppet bundle\", \"import_role\": {\"name\": \"tripleo_ha_wrapper\"}, \"vars\": {\"tripleo_ha_wrapper_service_name\": \"redis\", \"tripleo_ha_wrapper_resource_name\": \"redis\", \"tripleo_ha_wrapper_bundle_name\": \"redis-bundle\", \"tripleo_ha_wrapper_resource_state\": \"Slave Master\", \"tripleo_ha_wrapper_puppet_config_volume\": \"redis\", \"tripleo_ha_wrapper_puppet_execute\": \"include ::tripleo::profile::base::pacemaker; include ::tripleo::profile::pacemaker::database::redis_bundle\", \"tripleo_ha_wrapper_puppet_tags\": \"pacemaker::resource::bundle,pacemaker::property,pacemaker::resource::ocf,pacemaker::constraint::order,pacemaker::constraint::colocation\", \"tripleo_ha_wrapper_puppet_debug\": {\"get_param\": \"ConfigDebug\"}, \"tripleo_ha_wrapper_config_suffix\": \".previous_run\"}}], \"vars\": {\"tripleo_ha_wrapper_minor_update\": true}}], \"upgrade_tasks\": [{\"name\": \"redis_pacemaker_puppet_tmpfile_cleanup\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Clean old tmpfile configuration\", \"file\": {\"path\": \"/etc/tmpfiles.d/var-run-redis.conf\", \"state\": \"absent\"}}]}, {\"name\": \"Tear-down non-HA redis container\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Remove non-HA redis container\", \"include_role\": {\"name\": \"tripleo_container_rm\"}, \"vars\": {\"tripleo_container_cli\": \"{{ container_cli }}\", \"tripleo_containers_to_rm\": [\"redis\"]}}]}, {\"name\": \"Prepare switch of redis image name\", \"when\": [\"step|int == 0\"], \"block\": [{\"name\": \"Get redis image id currently used by pacemaker\", \"shell\": \"pcs resource config redis-bundle | grep -Eo 'image=[^ ]+' | awk -F= '{print $2;}'\", \"register\": \"redis_image_current_res\", \"failed_when\": false}, {\"name\": \"Image facts for redis\", \"set_fact\": {\"redis_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/redis:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"redis_image_current\": \"{{redis_image_current_res.stdout}}\"}}, {\"name\": \"Temporarily tag the current redis image id with the upgraded image name\", \"import_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{redis_image_current}}\", \"container_image_latest\": \"{{redis_image_latest}}\", \"pull_image\": false}, \"when\": [\"redis_image_current != ''\", \"redis_image_current != redis_image_latest\"]}, {\"name\": \"Create redis retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/redis_needs_retag\", \"state\": \"touch\"}, \"when\": [\"redis_image_current != ''\", \"redis_image_current != redis_image_latest\"]}]}, {\"name\": \"Update redis-bundle pcs resource bundle for new container image\", \"when\": [\"step|int == 1\"], \"block\": [{\"name\": \"Set upgrade redis facts\", \"set_fact\": {\"is_redis_bootstrap_node\": \"{{redis_short_bootstrap_node_name|lower == ansible_facts['hostname']|lower}}\"}}, {\"name\": \"Check for redis retag statefile\", \"stat\": {\"path\": \"/var/lib/tripleo/redis_needs_retag\"}, \"register\": \"redis_retag_state_file\"}]}, {\"name\": \"Update redis-bundle pcs resource bundle for new container image\", \"when\": [\"step|int == 1\", \"is_redis_bootstrap_node|bool\", \"redis_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the redis cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"redis-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Move redis logging to /var/log/containers\", \"block\": [{\"name\": \"Check redis logging configuration in pacemaker\", \"command\": \"cibadmin --query --xpath \\\"//storage-mapping[@id='redis-log' and @source-dir='/var/log/containers/redis']\\\"\", \"failed_when\": false, \"register\": \"redis_logs_moved\"}, {\"name\": \"Change redis logging configuration in pacemaker\", \"when\": \"redis_logs_moved.rc == 6\", \"block\": [{\"name\": \"Remove old bind mount for logging in the redis bundle\", \"command\": \"pcs resource bundle update redis-bundle storage-map remove redis-log\"}, {\"name\": \"Add a bind mount for logging in the redis bundle\", \"command\": \"pcs resource bundle update redis-bundle storage-map add id=redis-log source-dir=/var/log/containers/redis target-dir=/var/log/redis options=rw\"}]}]}, {\"name\": \"Update the redis bundle to use the new container image name\", \"command\": \"pcs resource bundle update redis-bundle container image={{redis_image_latest}}\"}, {\"name\": \"Enable the redis cluster resource\", \"pacemaker_resource\": {\"resource\": \"redis-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}]}, {\"name\": \"Check for redis retag statefile\", \"when\": [\"step|int == 3\"], \"stat\": {\"path\": \"/var/lib/tripleo/redis_needs_retag\"}, \"register\": \"redis_retag_state_file\"}, {\"name\": \"Retag redis-bundle container image\", \"when\": [\"step|int == 3\", \"redis_retag_state_file.stat.exists|bool\"], \"block\": [{\"name\": \"Disable the redis cluster resource before container upgrade\", \"pacemaker_resource\": {\"resource\": \"redis-bundle\", \"state\": \"disable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Retag the pacemaker image if containerized\", \"block\": [{\"block\": [{\"name\": \"Get redis image from pacemaker\", \"become\": true, \"register\": \"xmllint_pcmk_redis_image\", \"shell\": \"xmllint --xpath \\\"string(//bundle[@id='redis-bundle']/podman/@image)\\\" /var/lib/pacemaker/cib/cib.xml\"}, {\"name\": \"Get container redis image\", \"set_fact\": {\"redis_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"redis_image_latest\": {\"if\": [{\"get_param\": \"ClusterFullTag\"}, \"cluster.common.tag/redis:pcmklatest\", {\"yaql\": {\"data\": {\"if\": [{\"get_param\": \"ClusterCommonTag\"}, {\"yaql\": {\"data\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}, \"expression\": \"concat(\\\"cluster.common.tag/\\\", $.data.rightSplit(separator => \\\"/\\\", maxSplits => 1)[1])\"}}, {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerRedisImage\"]}]}, \"expression\": \"concat($.data.rightSplit(separator => \\\":\\\", maxSplits => 1)[0], \\\":pcmklatest\\\")\"}}]}, \"pcmk_redis_image\": \"{{xmllint_pcmk_redis_image.stdout}}\"}}]}, {\"block\": [{\"name\": \"Retag pcmklatest to latest redis image\", \"include_role\": {\"name\": \"tripleo_container_tag\"}, \"vars\": {\"container_image\": \"{{redis_image}}\", \"container_image_latest\": \"{{redis_image_latest}}\"}}]}]}, {\"name\": \"Enable the redis-bundle cluster resource\", \"pacemaker_resource\": {\"resource\": \"redis-bundle\", \"state\": \"enable\", \"wait_for_resource\": true}, \"register\": \"output\", \"retries\": 5, \"until\": \"output.rc == 0\"}, {\"name\": \"Remove redis retag statefile\", \"file\": {\"path\": \"/var/lib/tripleo/redis_needs_retag\", \"state\": \"absent\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Gnocchi service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"GnocchiIndexerBackend\": {\"default\": \"mysql\", \"description\": \"The short name of the Gnocchi indexer backend to use.\", \"type\": \"string\"}, \"NumberOfStorageSacks\": {\"default\": 128, \"description\": \"Number of storage sacks to create.\", \"type\": \"number\"}, \"GnocchiPassword\": {\"description\": \"The password for the gnocchi service and db account.\", \"type\": \"string\", \"hidden\": true}, \"GnocchiRbdPoolName\": {\"default\": \"metrics\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"GnocchiDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Gnocchi services.\", \"type\": \"boolean\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"GnocchiStorageSwiftEndpointType\": {\"default\": \"internalURL\", \"description\": \"Set to modify which endpoint type is gnocchi accessing swift from.\", \"type\": \"string\"}, \"GnocchiStorageS3Endpoint\": {\"default\": \"\", \"description\": \"The endpoint url for S3 storage.\", \"type\": \"string\"}, \"GnocchiStorageS3RegionName\": {\"default\": \"\", \"description\": \"S3 Region name.\", \"type\": \"string\"}, \"GnocchiStorageS3AccessKeyId\": {\"default\": \"\", \"description\": \"S3 storage access key Id.\", \"type\": \"string\"}, \"GnocchiStorageS3AccessSecret\": {\"default\": \"\", \"description\": \"S3 storage access key secret.\", \"type\": \"string\", \"hidden\": true}, \"GnocchiStorageS3BucketPrefix\": {\"default\": \"\", \"description\": \"S3 storage bucket prefix.\", \"type\": \"string\"}, \"GnocchiFileBasePath\": {\"default\": \"/var/lib/gnocchi\", \"description\": \"Path to use when file driver is used. This could be NFS or a flat file.\", \"type\": \"string\"}}, \"conditions\": {\"enable_sqlalchemy_collectd\": {\"equals\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, true]}}, \"outputs\": {\"aux_parameters\": {\"description\": \"Additional parameters referenced outside the base file\", \"value\": {\"gnocchi_indexer_backend\": {\"get_param\": \"GnocchiIndexerBackend\"}}}, \"role_data\": {\"description\": \"Shared role data for the Heat services.\", \"value\": {\"service_name\": \"gnocchi_base\", \"config_settings\": {\"gnocchi_redis_password\": {\"get_param\": \"RedisPassword\"}, \"gnocchi::logging::debug\": {\"if\": [{\"get_param\": \"GnocchiDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"gnocchi::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"gnocchi\", \"password\": {\"get_param\": \"GnocchiPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/gnocchi\", \"query\": {\"if\": [\"enable_sqlalchemy_collectd\", {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"gnochhi\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"gnocchi::db::sync::extra_opts\": {\"str_replace\": {\"template\": \" --sacks-number NUM_SACKS\", \"params\": {\"NUM_SACKS\": {\"get_param\": \"NumberOfStorageSacks\"}}}}, \"gnocchi::storage::file::file_basepath\": {\"get_param\": \"GnocchiFileBasePath\"}, \"gnocchi::storage::swift::swift_user\": \"service:gnocchi\", \"gnocchi::storage::swift::swift_auth_version\": 3, \"gnocchi::storage::swift::swift_key\": {\"get_param\": \"GnocchiPassword\"}, \"gnocchi::storage::swift::swift_authurl\": {\"get_param\": [\"EndpointMap\", \"KeystoneV3Internal\", \"uri\"]}, \"gnocchi::storage::swift::swift_endpoint_type\": {\"get_param\": \"GnocchiStorageSwiftEndpointType\"}, \"gnocchi::storage::ceph::ceph_pool\": {\"get_param\": \"GnocchiRbdPoolName\"}, \"gnocchi::storage::ceph::ceph_username\": {\"get_param\": \"CephClientUserName\"}, \"gnocchi::storage::ceph::ceph_conffile\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".conf\"]]}, \"gnocchi::storage::ceph::ceph_keyring\": {\"list_join\": [\"\", [\"/etc/ceph/\", {\"get_param\": \"CephClusterName\"}, \".client.\", {\"get_param\": \"CephClientUserName\"}, \".keyring\"]]}, \"gnocchi::storage::s3::s3_endpoint_url\": {\"get_param\": \"GnocchiStorageS3Endpoint\"}, \"gnocchi::storage::s3::s3_region_name\": {\"get_param\": \"GnocchiStorageS3RegionName\"}, \"gnocchi::storage::s3::s3_access_key_id\": {\"get_param\": \"GnocchiStorageS3AccessKeyId\"}, \"gnocchi::storage::s3::s3_secret_access_key\": {\"get_param\": \"GnocchiStorageS3AccessSecret\"}, \"gnocchi::storage::s3::s3_bucket_prefix\": {\"get_param\": \"GnocchiStorageS3BucketPrefix\"}, \"gnocchi::statsd::resource_id\": \"0a8b55df-f90f-491c-8cb9-7cdecec6fc26\", \"gnocchi::statsd::flush_delay\": 10, \"gnocchi::statsd::archive_policy_name\": \"low\"}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized gnocchi service\\n\", \"parameters\": {\"ContainerGnocchiApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerGnocchiConfigImage\": {\"description\": \"The container image to use for the gnocchi config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"GnocchiApiLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.gnocchi.api\", \"file\": \"/var/log/containers/gnocchi/app.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"NumberOfStorageSacks\": {\"default\": 128, \"description\": \"Number of storage sacks to create.\", \"type\": \"number\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"GnocchiFileBasePath\": {\"default\": \"/var/lib/gnocchi\", \"description\": \"Path to use when file driver is used. This could be NFS or a flat file.\", \"type\": \"string\"}, \"GnocchiPassword\": {\"description\": \"The password for the gnocchi service and db account.\", \"type\": \"string\", \"hidden\": true}, \"GnocchiBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Gnocchi backend to use. Should be one of swift, rbd, file or s3.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"file\", \"rbd\", \"s3\"]}]}, \"GnocchiNfsEnabled\": {\"default\": false, \"description\": \"When using GnocchiBackend 'file', mount NFS share for data storage\\n\", \"type\": \"boolean\"}, \"GnocchiNfsShare\": {\"default\": \"\", \"description\": \"NFS share to mount for data storage (when GnocchiNfsEnabled is true)\\n\", \"type\": \"string\"}, \"GnocchiNfsOptions\": {\"default\": \"_netdev,bg,intr,context=system_u:object_r:container_file_t:s0\", \"description\": \"Nfs mount options for data storage (when GnocchiNfsEnabled is true)\\n\", \"type\": \"string\"}, \"GnocchiIncomingStorageDriver\": {\"default\": \"redis\", \"description\": \"Storage driver to use for incoming metric data\", \"type\": \"string\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"MonitoringSubscriptionGnocchiApi\": {\"default\": \"overcloud-gnocchi-api\", \"type\": \"string\"}, \"GnocchiApiPolicies\": {\"description\": \"A hash of policies to configure for Gnocchi API.\\ne.g. { gnocchi-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"GnocchiCorsAllowedOrigin\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Indicate whether this resource may be shared with the domain received in the request \\\"origin\\\" header.\"}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}}, \"conditions\": {\"cors_allowed_origin_unset\": {\"equals\": [{\"get_param\": \"GnocchiCorsAllowedOrigin\"}, \"\"]}, \"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"nfs_backend_enabled\": {\"equals\": [{\"get_param\": \"GnocchiNfsEnabled\"}, true]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"GnocchiServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerGnocchiApiImage\": \"ContainerGnocchiApiImage\", \"ContainerGnocchiConfigImage\": \"ContainerGnocchiConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerGnocchiApiImage\": {\"get_param\": \"ContainerGnocchiApiImage\"}, \"ContainerGnocchiConfigImage\": {\"get_param\": \"ContainerGnocchiConfigImage\"}}}]}}}}, \"outputs\": {\"gnocchi_api_host_prep_and_system_upgrade_post_tasks\": {\"description\": \"Common host_prep and system_upgrade post tasks for gnocchi_api\", \"value\": [{\"name\": \"Mount Gnocchi NFS on host\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GnocchiNfsEnabled\"}, \"nfs_share\": {\"get_param\": \"GnocchiNfsShare\"}, \"nfs_options\": {\"get_param\": \"GnocchiNfsOptions\"}, \"file_base_path\": {\"get_param\": \"GnocchiFileBasePath\"}}, \"mount\": {\"name\": \"{{file_base_path}}\", \"state\": \"mounted\", \"src\": \"{{nfs_share}}\", \"fstype\": \"nfs\", \"opts\": \"{{nfs_options}}\"}, \"when\": \"nfs_backend_enabled\"}]}, \"role_data\": {\"description\": \"Role data for the gnocchi API role.\", \"value\": {\"service_name\": \"gnocchi_api\", \"firewall_rules\": {\"129 gnocchi-api\": {\"dport\": [8041]}}, \"firewall_frontend_rules\": {\"100 gnocchi_haproxy_frontend\": {\"dport\": [8041]}}, \"firewall_ssl_frontend_rules\": {\"100 gnocchi_haproxy_frontend_ssl\": {\"dport\": [13041]}}, \"keystone_resources\": {\"gnocchi\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"GnocchiPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"GnocchiInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"GnocchiAdmin\", \"uri\"]}}, \"users\": {\"gnocchi\": {\"password\": {\"get_param\": \"GnocchiPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"metric\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionGnocchiApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"GnocchiServiceBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"apache::default_vhost\": false}, {\"if\": [\"cors_allowed_origin_unset\", {}, {\"gnocchi::cors::allowed_origin\": {\"get_param\": \"GnocchiCorsAllowedOrigin\"}, \"gnocchi::api::middlewares\": \"oslo_middleware.cors.CORS\"}]}, {\"gnocchi::api::enabled\": true, \"gnocchi::api::enable_proxy_headers_parsing\": true, \"gnocchi::api::service_name\": \"httpd\", \"gnocchi::policy::policies\": {\"get_param\": \"GnocchiApiPolicies\"}, \"gnocchi::cors::max_age\": 3600, \"gnocchi::cors::allow_headers\": \"Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma,X-Auth-Token\", \"gnocchi::cors::expose_headers\": \"Content-Type,Cache-Control,Content-Language,Expires,Last-Modified,Pragma\", \"gnocchi::cors::allow_methods\": \"GET,POST,PUT,DELETE,OPTIONS,PATCH\", \"gnocchi::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"gnocchi::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"gnocchi::keystone::authtoken::password\": {\"get_param\": \"GnocchiPassword\"}, \"gnocchi::keystone::authtoken::project_name\": \"service\", \"gnocchi::keystone::authtoken::user_domain_name\": \"Default\", \"gnocchi::keystone::authtoken::project_domain_name\": \"Default\", \"gnocchi::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"gnocchi::keystone::authtoken::interface\": \"internal\", \"gnocchi::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"gnocchi::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"gnocchi::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}}}, \"tripleo::profile::base::gnocchi::api::gnocchi_backend\": {\"get_param\": \"GnocchiBackend\"}, \"tripleo::profile::base::gnocchi::api::incoming_storage_driver\": {\"get_param\": \"GnocchiIncomingStorageDriver\"}, \"tripleo::profile::base::gnocchi::api::gnocchi_rbd_ceph_conf_path\": {\"get_param\": \"CephConfigPath\"}, \"gnocchi::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"GnocchiApiNetwork\"]}}}}, \"gnocchi::wsgi::apache::wsgi_process_display_name\": \"gnocchi_wsgi\"}]}, \"service_config_settings\": {\"map_merge\": [{\"get_attr\": [\"GnocchiServiceBase\", \"role_data\", \"service_config_settings\"]}, {\"rsyslog\": {\"tripleo_logging_sources_gnocchi_api\": [{\"get_param\": \"GnocchiApiLoggingSource\"}]}, \"mysql\": {\"gnocchi::db::mysql::password\": {\"get_param\": \"GnocchiPassword\"}, \"gnocchi::db::mysql::user\": \"gnocchi\", \"gnocchi::db::mysql::host\": \"%\", \"gnocchi::db::mysql::dbname\": \"gnocchi\"}}]}, \"puppet_config\": {\"config_volume\": \"gnocchi\", \"puppet_tags\": \"gnocchi_api_paste_ini,gnocchi_config,exec\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::gnocchi::api\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/gnocchi_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/gnocchi\", \"owner\": \"gnocchi:gnocchi\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"gnocchi:gnocchi\", \"perm\": \"0600\"}, {\"path\": {\"list_join\": [\"/\", [{\"get_param\": \"GnocchiFileBasePath\"}, \"tmp\"]]}, \"owner\": \"gnocchi:gnocchi\", \"perm\": \"0750\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/gnocchi_db_sync.json\": {\"command\": {\"str_replace\": {\"template\": \"/usr/bin/bootstrap_host_exec gnocchi_api /usr/bin/gnocchi-upgrade --sacks-number=SACK_NUM\", \"params\": {\"SACK_NUM\": {\"get_param\": \"NumberOfStorageSacks\"}}}}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/gnocchi\", \"owner\": \"gnocchi:gnocchi\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"gnocchi:gnocchi\", \"perm\": \"0600\"}, {\"path\": {\"list_join\": [\"/\", [{\"get_param\": \"GnocchiFileBasePath\"}, \"tmp\"]]}, \"owner\": \"gnocchi:gnocchi\", \"perm\": \"0750\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"gnocchi_init_log\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiApiImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [\"/var/log/containers/gnocchi:/var/log/gnocchi:z\", \"/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R gnocchi:gnocchi /var/log/gnocchi\"]}, \"gnocchi_init_lib\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiApiImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [{\"str_replace\": {\"template\": \"GNOCCHI_FILE_BASE_PATH:GNOCCHI_FILE_BASE_PATH:SE_FLAGS\", \"params\": {\"GNOCCHI_FILE_BASE_PATH\": {\"get_param\": \"GnocchiFileBasePath\"}, \"SE_FLAGS\": {\"if\": [\"nfs_backend_enabled\", \"shared\", \"shared,z\"]}}}}], \"command\": [\"/bin/bash\", \"-c\", {\"str_replace\": {\"template\": \"chown -R gnocchi:gnocchi GNOCCHI_FILE_BASE_PATH\", \"params\": {\"GNOCCHI_FILE_BASE_PATH\": {\"get_param\": \"GnocchiFileBasePath\"}}}}]}}, \"step_5\": {\"gnocchi_db_sync\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"detach\": false, \"privileged\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/gnocchi_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro\", {\"str_replace\": {\"template\": \"GNOCCHI_FILE_BASE_PATH:GNOCCHI_FILE_BASE_PATH:SE_FLAGS\", \"params\": {\"GNOCCHI_FILE_BASE_PATH\": {\"get_param\": \"GnocchiFileBasePath\"}, \"SE_FLAGS\": {\"if\": [\"nfs_backend_enabled\", \"shared\", \"shared,z\"]}}}}, \"/var/log/containers/gnocchi:/var/log/gnocchi:z\", \"/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}, \"gnocchi_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiApiImage\"]}, \"start_order\": 1, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [{\"str_replace\": {\"template\": \"GNOCCHI_FILE_BASE_PATH:GNOCCHI_FILE_BASE_PATH:SE_FLAGS\", \"params\": {\"GNOCCHI_FILE_BASE_PATH\": {\"get_param\": \"GnocchiFileBasePath\"}, \"SE_FLAGS\": {\"if\": [\"nfs_backend_enabled\", \"shared\", \"shared,z\"]}}}}, \"/var/lib/kolla/config_files/gnocchi_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/gnocchi:/var/log/gnocchi:z\", \"/var/log/containers/httpd/gnocchi-api:/var/log/httpd:z\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}], {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\"], []]}, {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"], []]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"list_concat\": [[{\"name\": \"create logs directory\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/gnocchi\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/gnocchi-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], [{\"name\": \"Mount Gnocchi NFS on host\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GnocchiNfsEnabled\"}, \"nfs_share\": {\"get_param\": \"GnocchiNfsShare\"}, \"nfs_options\": {\"get_param\": \"GnocchiNfsOptions\"}, \"file_base_path\": {\"get_param\": \"GnocchiFileBasePath\"}}, \"mount\": {\"name\": \"{{file_base_path}}\", \"state\": \"mounted\", \"src\": \"{{nfs_share}}\", \"fstype\": \"nfs\", \"opts\": \"{{nfs_options}}\"}, \"when\": \"nfs_backend_enabled\"}], [{\"name\": \"ensure GnocchiFileBasePath exists\", \"file\": {\"path\": {\"get_param\": \"GnocchiFileBasePath\"}, \"state\": \"directory\", \"setype\": \"container_file_t\"}}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}]]}, \"upgrade_tasks\": [{\"name\": \"gnocchi-api pre system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 3\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Unmount Gnocchi NFS share\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GnocchiNfsEnabled\"}, \"file_base_path\": {\"get_param\": \"GnocchiFileBasePath\"}}, \"mount\": {\"name\": \"{{file_base_path}}\", \"state\": \"absent\", \"fstype\": \"nfs\"}, \"when\": \"nfs_backend_enabled\"}]}, {\"name\": \"gnocchi-api post system_upgrade tasks\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_run\", \"system_upgrade_nfsmounts\"], \"when\": [\"step|int == 5\", \"upgrade_leapp_enabled\"], \"block\": [{\"name\": \"Mount Gnocchi NFS on host\", \"vars\": {\"nfs_backend_enabled\": {\"get_param\": \"GnocchiNfsEnabled\"}, \"nfs_share\": {\"get_param\": \"GnocchiNfsShare\"}, \"nfs_options\": {\"get_param\": \"GnocchiNfsOptions\"}, \"file_base_path\": {\"get_param\": \"GnocchiFileBasePath\"}}, \"mount\": {\"name\": \"{{file_base_path}}\", \"state\": \"mounted\", \"src\": \"{{nfs_share}}\", \"fstype\": \"nfs\", \"opts\": \"{{nfs_options}}\"}, \"when\": \"nfs_backend_enabled\"}]}], \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop gnocchi container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"gnocchi_api\"], \"tripleo_delegate_to\": \"{{ groups['gnocchi_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-metricd-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Gnocchi Metricd service\\n\", \"parameters\": {\"ContainerGnocchiMetricdImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerGnocchiConfigImage\": {\"description\": \"The container image to use for the gnocchi config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"GnocchiFileBasePath\": {\"default\": \"/var/lib/gnocchi\", \"description\": \"Path to use when file driver is used. This could be NFS or a flat file.\", \"type\": \"string\"}, \"GnocchiNfsEnabled\": {\"default\": false, \"description\": \"When using GnocchiBackend 'file', mount NFS share for data storage\\n\", \"type\": \"boolean\"}, \"MonitoringSubscriptionGnocchiMetricd\": {\"default\": \"overcloud-gnocchi-metricd\", \"type\": \"string\"}, \"GnocchiMetricdWorkers\": {\"default\": \"%{::os_workers}\", \"description\": \"Number of workers for Gnocchi MetricD\", \"type\": \"string\"}, \"MetricProcessingDelay\": {\"default\": 30, \"description\": \"Delay between processing metrics.\", \"type\": \"number\"}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"conditions\": {\"nfs_backend_enabled\": {\"equals\": [{\"get_param\": \"GnocchiNfsEnabled\"}, true]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"GnocchiServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerGnocchiMetricdImage\": \"ContainerGnocchiMetricdImage\", \"ContainerGnocchiConfigImage\": \"ContainerGnocchiConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerGnocchiMetricdImage\": {\"get_param\": \"ContainerGnocchiMetricdImage\"}, \"ContainerGnocchiConfigImage\": {\"get_param\": \"ContainerGnocchiConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Gnocchi API role.\", \"value\": {\"service_name\": \"gnocchi_metricd\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"GnocchiServiceBase\", \"role_data\", \"config_settings\"]}, {\"gnocchi::metricd::workers\": {\"get_param\": \"GnocchiMetricdWorkers\"}, \"gnocchi::metricd::metric_processing_delay\": {\"get_param\": \"MetricProcessingDelay\"}}]}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionGnocchiMetricd\"}, \"service_config_settings\": {\"get_attr\": [\"GnocchiServiceBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"gnocchi\", \"puppet_tags\": \"gnocchi_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::gnocchi::metricd\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/gnocchi_metricd.json\": {\"command\": \"/usr/bin/gnocchi-metricd\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/gnocchi\", \"owner\": \"gnocchi:gnocchi\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"gnocchi:gnocchi\", \"perm\": \"0600\"}]}}, \"docker_config\": {\"step_5\": {\"gnocchi_metricd\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiMetricdImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/gnocchi_metricd.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/gnocchi:/var/log/gnocchi:z\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, {\"str_replace\": {\"template\": \"GNOCCHI_FILE_BASE_PATH:GNOCCHI_FILE_BASE_PATH:SE_FLAGS\", \"params\": {\"GNOCCHI_FILE_BASE_PATH\": {\"get_param\": \"GnocchiFileBasePath\"}, \"SE_FLAGS\": {\"if\": [\"nfs_backend_enabled\", \"shared\", \"shared,z\"]}}}}]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/gnocchi\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"create persistent data directory\", \"file\": {\"path\": {\"get_param\": \"GnocchiFileBasePath\"}, \"state\": \"directory\", \"setype\": \"container_file_t\"}}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}], \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop gnocchi metricd container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"gnocchi_metricd\"], \"tripleo_delegate_to\": \"{{ groups['gnocchi_metricd'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-statsd-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Gnocchi Statsd service\\n\", \"parameters\": {\"ContainerGnocchiStatsdImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerGnocchiConfigImage\": {\"description\": \"The container image to use for the gnocchi config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"GnocchiFileBasePath\": {\"default\": \"/var/lib/gnocchi\", \"description\": \"Path to use when file driver is used. This could be NFS or a flat file.\", \"type\": \"string\"}, \"GnocchiNfsEnabled\": {\"default\": false, \"description\": \"When using GnocchiBackend 'file', mount NFS share for data storage\\n\", \"type\": \"boolean\"}, \"MonitoringSubscriptionGnocchiStatsd\": {\"default\": \"overcloud-gnocchi-statsd\", \"type\": \"string\"}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}}, \"conditions\": {\"nfs_backend_enabled\": {\"equals\": [{\"get_param\": \"GnocchiNfsEnabled\"}, true]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"GnocchiServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/gnocchi/gnocchi-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerGnocchiStatsdImage\": \"ContainerGnocchiStatsdImage\", \"ContainerGnocchiConfigImage\": \"ContainerGnocchiConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerGnocchiStatsdImage\": {\"get_param\": \"ContainerGnocchiStatsdImage\"}, \"ContainerGnocchiConfigImage\": {\"get_param\": \"ContainerGnocchiConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Gnocchi API role.\", \"value\": {\"service_name\": \"gnocchi_statsd\", \"firewall_rules\": {\"140 gnocchi-statsd\": {\"dport\": 8125, \"proto\": \"udp\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionGnocchiStatsd\"}, \"config_settings\": {\"get_attr\": [\"GnocchiServiceBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"get_attr\": [\"GnocchiServiceBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"gnocchi\", \"puppet_tags\": \"gnocchi_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::gnocchi::statsd\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/gnocchi_statsd.json\": {\"command\": \"/usr/bin/gnocchi-statsd\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-ceph/\", \"dest\": \"/etc/ceph/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/gnocchi\", \"owner\": \"gnocchi:gnocchi\", \"recurse\": true}, {\"path\": {\"str_replace\": {\"template\": \"/etc/ceph/CLUSTER.client.USER.keyring\", \"params\": {\"CLUSTER\": {\"get_param\": \"CephClusterName\"}, \"USER\": {\"get_param\": \"CephClientUserName\"}}}}, \"owner\": \"gnocchi:gnocchi\", \"perm\": \"0600\"}]}}, \"docker_config\": {\"step_5\": {\"gnocchi_statsd\": {\"start_order\": 1, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerGnocchiStatsdImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/gnocchi_statsd.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/gnocchi:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/gnocchi:/var/log/gnocchi:z\", {\"list_join\": [\":\", [{\"get_param\": \"CephConfigPath\"}], [\"/var/lib/kolla/config_files/src-ceph\"], [\"z\"]]}, {\"str_replace\": {\"template\": \"GNOCCHI_FILE_BASE_PATH:GNOCCHI_FILE_BASE_PATH:SE_FLAGS\", \"params\": {\"GNOCCHI_FILE_BASE_PATH\": {\"get_param\": \"GnocchiFileBasePath\"}, \"SE_FLAGS\": {\"if\": [\"nfs_backend_enabled\", \"shared\", \"shared,z\"]}}}}]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/gnocchi\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"create persistent data directory\", \"file\": {\"path\": {\"get_param\": \"GnocchiFileBasePath\"}, \"state\": \"directory\", \"setype\": \"container_file_t\"}}, {\"name\": \"ensure ceph configurations exist\", \"file\": {\"path\": {\"get_param\": \"CephConfigPath\"}, \"state\": \"directory\"}}], \"upgrade_tasks\": [], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop gnocchi statsd container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"gnocchi_statsd\"], \"tripleo_delegate_to\": \"{{ groups['gnocchi_statsd'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Aodh service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"AodhPassword\": {\"description\": \"The password for the aodh services.\", \"type\": \"string\", \"hidden\": true}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"AodhDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Aodh services.\", \"type\": \"boolean\"}, \"EnableSQLAlchemyCollectd\": {\"type\": \"boolean\", \"description\": \"Set to true to enable the SQLAlchemy-collectd server plugin\\n\", \"default\": false}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Aodh role.\", \"value\": {\"service_name\": \"aodh_base\", \"config_settings\": {\"aodh_redis_password\": {\"get_param\": \"RedisPassword\"}, \"aodh::db::database_connection\": {\"make_url\": {\"scheme\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"protocol\"]}, \"username\": \"aodh\", \"password\": {\"get_param\": \"AodhPassword\"}, \"host\": {\"get_param\": [\"EndpointMap\", \"MysqlInternal\", \"host\"]}, \"path\": \"/aodh\", \"query\": {\"if\": [{\"get_param\": \"EnableSQLAlchemyCollectd\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\", \"plugin\": \"collectd\", \"collectd_program_name\": \"aodh\", \"collectd_host\": \"localhost\"}, {\"read_default_file\": \"/etc/my.cnf.d/tripleo.cnf\", \"read_default_group\": \"tripleo\"}]}}}, \"aodh::logging::debug\": {\"if\": [{\"get_param\": \"AodhDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"aodh::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"aodh::rabbit_heartbeat_in_pthread\": false, \"aodh::service_credentials::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"aodh::service_credentials::password\": {\"get_param\": \"AodhPassword\"}, \"aodh::service_credentials::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"aodh::service_credentials::project_name\": \"service\", \"aodh::service_credentials::user_domain_name\": \"Default\", \"aodh::service_credentials::project_domain_name\": \"Default\"}, \"service_config_settings\": {\"mysql\": {\"aodh::db::mysql::user\": \"aodh\", \"aodh::db::mysql::password\": {\"get_param\": \"AodhPassword\"}, \"aodh::db::mysql::host\": \"%\", \"aodh::db::mysql::dbname\": \"aodh\"}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-api-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized aodh service\\n\", \"parameters\": {\"ContainerAodhApiImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerAodhConfigImage\": {\"description\": \"The container image to use for the aodh config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"DeployIdentifier\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update.\\n\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"GnocchiExternalProject\": {\"default\": \"service\", \"description\": \"Project name of resources creator in Gnocchi.\", \"type\": \"string\"}, \"MonitoringSubscriptionAodhApi\": {\"default\": \"overcloud-ceilometer-aodh-api\", \"type\": \"string\"}, \"AodhApiPolicies\": {\"description\": \"A hash of policies to configure for Aodh API.\\ne.g. { aodh-context_is_admin: { key: context_is_admin, value: 'role:admin' } }\\n\", \"default\": {}, \"type\": \"json\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"AodhPassword\": {\"description\": \"The password for the aodh services.\", \"type\": \"string\", \"hidden\": true}, \"AodhAlarmHistoryTTL\": {\"description\": \"Number of seconds that alarm histories are kept in the database\", \"default\": \"86400\", \"type\": \"string\"}, \"EnableAodhExpirer\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Enable aodh expirer to periodically delete alarms from db\"}, \"AodhExpirerMinute\": {\"type\": \"string\", \"description\": \"Cron to delete alarms data from db - Minute\\n\", \"default\": \"1\"}, \"AodhExpirerHour\": {\"type\": \"string\", \"description\": \"Cron to delete alarms data from db - Hour\\n\", \"default\": \"0\"}, \"AodhExpirerMonthday\": {\"type\": \"string\", \"description\": \"Cron to delete alarms data from db - Month Day\\n\", \"default\": \"*\"}, \"AodhExpirerMonth\": {\"type\": \"string\", \"description\": \"Cron to delete alarms data from db - Month\\n\", \"default\": \"*\"}, \"AodhExpirerWeekday\": {\"type\": \"string\", \"description\": \"Cron to delete alarms from db - Week Day\\n\", \"default\": \"*\"}, \"AodhExpirerMaxDelay\": {\"type\": \"string\", \"description\": \"Cron to delete alarms from db - Max Delay\\n\", \"default\": \"3600\"}, \"MemcacheUseAdvancedPool\": {\"type\": \"boolean\", \"description\": \"Use the advanced (eventlet safe) memcached client pool.\\n\", \"default\": true}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"AodhBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"ApacheServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/apache/apache-baremetal-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}, \"EnableInternalTLS\": {\"get_param\": \"EnableInternalTLS\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerAodhApiImage\": \"ContainerAodhApiImage\", \"ContainerAodhConfigImage\": \"ContainerAodhConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerAodhApiImage\": {\"get_param\": \"ContainerAodhApiImage\"}, \"ContainerAodhConfigImage\": {\"get_param\": \"ContainerAodhConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the aodh API role.\", \"value\": {\"service_name\": \"aodh_api\", \"firewall_rules\": {\"128 aodh-api\": {\"dport\": [8042]}}, \"firewall_frontend_rules\": {\"100 aodh_haproxy_frontend\": {\"dport\": [8042]}}, \"firewall_ssl_frontend_rules\": {\"100 aodh_haproxy_frontend_ssl\": {\"dport\": [13042]}}, \"keystone_resources\": {\"aodh\": {\"endpoints\": {\"public\": {\"get_param\": [\"EndpointMap\", \"AodhPublic\", \"uri\"]}, \"internal\": {\"get_param\": [\"EndpointMap\", \"AodhInternal\", \"uri\"]}, \"admin\": {\"get_param\": [\"EndpointMap\", \"AodhAdmin\", \"uri\"]}}, \"users\": {\"aodh\": {\"password\": {\"get_param\": \"AodhPassword\"}}}, \"region\": {\"get_param\": \"KeystoneRegion\"}, \"service\": \"alarming\"}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionAodhApi\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"AodhBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"config_settings\"]}, {\"apache::default_vhost\": false, \"aodh::wsgi::apache::ssl\": {\"get_param\": \"EnableInternalTLS\"}, \"aodh::wsgi::apache::servername\": {\"str_replace\": {\"template\": \"%{hiera('fqdn_$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}}}, \"aodh::wsgi::apache::wsgi_process_display_name\": \"aodh_wsgi\", \"aodh::api::service_name\": \"httpd\", \"aodh::api::enable_proxy_headers_parsing\": true, \"aodh::api::gnocchi_external_project_owner\": {\"get_param\": \"GnocchiExternalProject\"}, \"aodh::keystone::authtoken::project_name\": \"service\", \"aodh::keystone::authtoken::user_domain_name\": \"Default\", \"aodh::keystone::authtoken::project_domain_name\": \"Default\", \"aodh::keystone::authtoken::password\": {\"get_param\": \"AodhPassword\"}, \"aodh::keystone::authtoken::www_authenticate_uri\": {\"get_param\": [\"EndpointMap\", \"KeystonePublic\", \"uri_no_suffix\"]}, \"aodh::keystone::authtoken::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"aodh::keystone::authtoken::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"aodh::keystone::authtoken::interface\": \"internal\", \"aodh::keystone::authtoken::memcache_use_advanced_pool\": {\"get_param\": \"MemcacheUseAdvancedPool\"}, \"aodh::policy::policies\": {\"get_param\": \"AodhApiPolicies\"}, \"aodh::wsgi::apache::bind_host\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"AodhApiNetwork\"]}}}}, \"aodh::alarm_history_time_to_live\": {\"get_param\": \"AodhAlarmHistoryTTL\"}, \"enable_aodh_expirer\": {\"get_param\": \"EnableAodhExpirer\"}, \"aodh::expirer::minute\": {\"get_param\": \"AodhExpirerMinute\"}, \"aodh::expirer::hour\": {\"get_param\": \"AodhExpirerHour\"}, \"aodh::expirer::monthday\": {\"get_param\": \"AodhExpirerMonthday\"}, \"aodh::expirer::month\": {\"get_param\": \"AodhExpirerMonth\"}, \"aodh::expirer::weekday\": {\"get_param\": \"AodhExpirerWeekday\"}, \"aodh::expirer::maxdelay\": {\"get_param\": \"AodhExpirerMaxDelay\"}}]}, \"service_config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"aodh\", \"puppet_tags\": \"aodh_api_paste_ini,aodh_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::aodh::api\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/aodh_api.json\": {\"command\": \"/usr/sbin/httpd -DFOREGROUND\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/aodh\", \"owner\": \"aodh:aodh\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/aodh_api_db_sync.json\": {\"command\": \"/usr/bin/bootstrap_host_exec aodh_api su aodh -s /bin/bash -c /usr/bin/aodh-dbsync\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.d\", \"dest\": \"/etc/httpd/conf.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d\", \"dest\": \"/etc/httpd/conf.modules.d\", \"merge\": false, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/aodh\", \"owner\": \"aodh:aodh\", \"recurse\": true}]}, \"/var/lib/kolla/config_files/aodh_api_cron.json\": {\"command\": \"/usr/sbin/crond -n\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/aodh\", \"owner\": \"aodh:aodh\", \"recurse\": true}]}}, \"docker_config\": {\"step_2\": {\"aodh_init_log\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhApiImage\"]}, \"net\": \"none\", \"user\": \"root\", \"volumes\": [\"/var/log/containers/aodh:/var/log/aodh:z\", \"/var/log/containers/httpd/aodh-api:/var/log/httpd:z\"], \"command\": [\"/bin/bash\", \"-c\", \"chown -R aodh:aodh /var/log/aodh\"]}}, \"step_3\": {\"aodh_db_sync\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhApiImage\"]}, \"cap_add\": [\"AUDIT_WRITE\"], \"net\": \"host\", \"privileged\": false, \"detach\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/aodh_api_db_sync.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/aodh:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/aodh:/var/log/aodh\", \"/var/log/containers/httpd/aodh-api:/var/log/httpd\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\", \"TRIPLEO_DEPLOY_IDENTIFIER\": {\"get_param\": \"DeployIdentifier\"}}}}, \"step_4\": {\"aodh_api\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhApiImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/aodh_api.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/aodh:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/aodh:/var/log/aodh\", \"/var/log/containers/httpd/aodh-api:/var/log/httpd\"], {\"if\": [{\"get_param\": \"EnableInternalTLS\"}, [\"/etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro\", \"/etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro\"]]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}, \"aodh_api_cron\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhApiImage\"]}, \"net\": \"host\", \"user\": \"root\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/usr/share/openstack-tripleo-common/healthcheck/cron aodh\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/aodh_api_cron.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/aodh:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/aodh:/var/log/aodh\", \"/var/log/containers/httpd/aodh-api:/var/log/httpd\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent logs directory\", \"file\": {\"path\": \"{{ item.path }}\", \"setype\": \"{{ item.setype }}\", \"state\": \"directory\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/aodh\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/containers/httpd/aodh-api\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"metadata_settings\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"metadata_settings\"]}, \"deploy_steps_tasks\": {\"get_attr\": [\"ApacheServiceBase\", \"role_data\", \"deploy_steps_tasks\"]}, \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop aodh api container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"aodh_api\", \"aodh_api_cron\"], \"tripleo_delegate_to\": \"{{ groups['aodh_api'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-evaluator-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Aodh Evaluator service\\n\", \"parameters\": {\"ContainerAodhEvaluatorImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerAodhConfigImage\": {\"description\": \"The container image to use for the aodh config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionAodhEvaluator\": {\"default\": \"overcloud-ceilometer-aodh-evaluator\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"AodhBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerAodhEvaluatorImage\": \"ContainerAodhEvaluatorImage\", \"ContainerAodhConfigImage\": \"ContainerAodhConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerAodhEvaluatorImage\": {\"get_param\": \"ContainerAodhEvaluatorImage\"}, \"ContainerAodhConfigImage\": {\"get_param\": \"ContainerAodhConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Aodh API role.\", \"value\": {\"service_name\": \"aodh_evaluator\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionAodhEvaluator\"}, \"config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"aodh\", \"puppet_tags\": \"aodh_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::aodh::evaluator\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/aodh_evaluator.json\": {\"command\": \"/usr/bin/aodh-evaluator\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/aodh\", \"owner\": \"aodh:aodh\", \"recurse\": true}]}}, \"docker_config\": {\"step_4\": {\"aodh_evaluator\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhEvaluatorImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/aodh_evaluator.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/aodh:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/aodh:/var/log/aodh:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/aodh\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop aodh evaluator container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"aodh_evaluator\"], \"tripleo_delegate_to\": \"{{ groups['aodh_evaluator'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-notifier-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Aodh Notifier service\\n\", \"parameters\": {\"ContainerAodhNotifierImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerAodhConfigImage\": {\"description\": \"The container image to use for the aodh config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionAodhNotifier\": {\"default\": \"overcloud-ceilometer-aodh-notifier\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"AodhBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerAodhNotifierImage\": \"ContainerAodhNotifierImage\", \"ContainerAodhConfigImage\": \"ContainerAodhConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerAodhNotifierImage\": {\"get_param\": \"ContainerAodhNotifierImage\"}, \"ContainerAodhConfigImage\": {\"get_param\": \"ContainerAodhConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Aodh API role.\", \"value\": {\"service_name\": \"aodh_notifier\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionAodhNotifier\"}, \"config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"aodh\", \"puppet_tags\": \"aodh_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::aodh::notifier\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/aodh_notifier.json\": {\"command\": \"/usr/bin/aodh-notifier\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/aodh\", \"owner\": \"aodh:aodh\", \"recurse\": true}]}}, \"docker_config\": {\"step_4\": {\"aodh_notifier\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhNotifierImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/aodh_notifier.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/aodh:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/aodh:/var/log/aodh:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode|default(omit) }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/aodh\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}, {\"path\": \"/var/log/aodh\", \"setype\": \"container_file_t\"}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop aodh notifier container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"aodh_notifier\"], \"tripleo_delegate_to\": \"{{ groups['aodh_notifier'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-listener-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Aodh Listener service\\n\", \"parameters\": {\"ContainerAodhListenerImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerAodhConfigImage\": {\"description\": \"The container image to use for the aodh config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionAodhListener\": {\"default\": \"overcloud-ceilometer-aodh-listener\", \"type\": \"string\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"MySQLClient\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/database/mysql-client.yaml\"}, \"AodhBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/aodh/aodh-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerAodhListenerImage\": \"ContainerAodhListenerImage\", \"ContainerAodhConfigImage\": \"ContainerAodhConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerAodhListenerImage\": {\"get_param\": \"ContainerAodhListenerImage\"}, \"ContainerAodhConfigImage\": {\"get_param\": \"ContainerAodhConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Aodh API role.\", \"value\": {\"service_name\": \"aodh_listener\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionAodhListener\"}, \"config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"config_settings\"]}, \"service_config_settings\": {\"get_attr\": [\"AodhBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"aodh\", \"puppet_tags\": \"aodh_config\", \"step_config\": {\"list_join\": [\"\\n\", [\"include tripleo::profile::base::aodh::listener\", {\"get_attr\": [\"MySQLClient\", \"role_data\", \"step_config\"]}]]}, \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/aodh_listener.json\": {\"command\": \"/usr/bin/aodh-listener\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/aodh\", \"owner\": \"aodh:aodh\", \"recurse\": true}]}}, \"docker_config\": {\"step_4\": {\"aodh_listener\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerAodhListenerImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/aodh_listener.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/aodh:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/aodh:/var/log/aodh:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/aodh\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop aodh listener container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"aodh_listener\"], \"tripleo_delegate_to\": \"{{ groups['aodh_listener'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-base-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Ceilometer service configured with Puppet\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CeilometerMeteringSecret\": {\"description\": \"Secret shared by the ceilometer services.\", \"type\": \"string\", \"hidden\": true}, \"CeilometerPassword\": {\"description\": \"The password for the ceilometer service account.\", \"type\": \"string\", \"hidden\": true}, \"AmqpRpcAddressPrefix\": {\"default\": \"\", \"description\": \"Address prefix for RPC addresses\", \"type\": \"string\"}, \"AmqpNotifyAddressPrefix\": {\"default\": \"\", \"description\": \"Address prefix for Notification addresses\", \"type\": \"string\"}, \"ManagePolling\": {\"default\": false, \"description\": \"Whether to manage polling.yaml.\", \"type\": \"boolean\"}, \"Debug\": {\"default\": false, \"description\": \"Set to True to enable debugging on all services.\", \"type\": \"boolean\"}, \"CeilometerDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging Ceilometer services.\", \"type\": \"boolean\"}, \"KeystoneRegion\": {\"type\": \"string\", \"default\": \"regionOne\", \"description\": \"Keystone region for endpoint\"}, \"SnmpdReadonlyUserName\": {\"default\": \"ro_snmp_user\", \"description\": \"The user name for SNMPd with readonly rights running on all Overcloud nodes\", \"type\": \"string\"}, \"SnmpdReadonlyUserPassword\": {\"description\": \"The user password for SNMPd with readonly rights running on all Overcloud nodes\", \"type\": \"string\", \"hidden\": true}, \"NotificationDriver\": {\"type\": \"comma_delimited_list\", \"default\": \"noop\", \"description\": \"Driver or drivers to handle sending notifications.\"}, \"GnocchiArchivePolicy\": {\"default\": \"ceilometer-low-rate\", \"type\": \"string\", \"description\": \"(DEPRECATED) archive policy to use with gnocchi backend\"}, \"EnableCache\": {\"description\": \"Enable caching with memcached\", \"type\": \"boolean\", \"default\": true}, \"MemcachedTLS\": {\"default\": false, \"description\": \"Set to True to enable TLS on Memcached service. Because not all services support Memcached TLS, during the migration period, Memcached will listen on 2 ports - on the port set with MemcachedPort parameter (above) and on 11211, without TLS.\", \"type\": \"boolean\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"The following parameters are deprecated and will be removed. They should not\\nbe relied on for new deployments. If you have concerns regarding deprecated\\nparameters, please contact the TripleO development team on IRC or the\\nOpenStack mailing list.\\n\", \"parameters\": [\"GnocchiArchivePolicy\"]}], \"conditions\": {\"tls_cache_enabled\": {\"and\": [{\"get_param\": \"EnableCache\"}, {\"get_param\": \"MemcachedTLS\"}]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceilometer role.\", \"value\": {\"service_name\": \"ceilometer_base\", \"config_settings\": {\"map_merge\": [{\"ceilometer::logging::debug\": {\"if\": [{\"get_param\": \"CeilometerDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"ceilometer::agent::polling::manage_polling\": {\"get_param\": \"ManagePolling\"}, \"ceilometer::agent::service_credentials::password\": {\"get_param\": \"CeilometerPassword\"}, \"ceilometer::agent::service_credentials::auth_url\": {\"get_param\": [\"EndpointMap\", \"KeystoneInternal\", \"uri_no_suffix\"]}, \"ceilometer::agent::service_credentials::region_name\": {\"get_param\": \"KeystoneRegion\"}, \"ceilometer::agent::service_credentials::project_name\": \"service\", \"ceilometer::agent::service_credentials::user_domain_name\": \"Default\", \"ceilometer::agent::service_credentials::auth_project_domain_name\": \"Default\", \"ceilometer::agent::service_credentials::interface\": \"internalURL\", \"ceilometer::notification_driver\": {\"get_param\": \"NotificationDriver\"}, \"ceilometer::amqp_rpc_address_prefix\": {\"get_param\": \"AmqpRpcAddressPrefix\"}, \"ceilometer::amqp_notify_address_prefix\": {\"get_param\": \"AmqpNotifyAddressPrefix\"}, \"ceilometer::telemetry_secret\": {\"get_param\": \"CeilometerMeteringSecret\"}, \"ceilometer::snmpd_readonly_username\": {\"get_param\": \"SnmpdReadonlyUserName\"}, \"ceilometer::snmpd_readonly_user_password\": {\"get_param\": \"SnmpdReadonlyUserPassword\"}, \"ceilometer::host\": \"%{hiera('fqdn_canonical')}\", \"ceilometer::rabbit_heartbeat_in_pthread\": false, \"ceilometer::cache::enabled\": {\"get_param\": \"EnableCache\"}, \"ceilometer::cache::tls_enabled\": {\"get_param\": \"MemcachedTLS\"}}, {\"if\": [\"tls_cache_enabled\", {\"ceilometer::cache::backend\": \"dogpile.cache.pymemcache\", \"ceilometer::cache::enable_socket_keepalive\": true}, {\"ceilometer::cache::backend\": \"dogpile.cache.memcached\"}]}]}, \"service_config_settings\": {\"keystone\": {\"tripleo::profile::base::keystone::ceilometer_notification_topics\": [\"notifications\"]}}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-agent-central-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Ceilometer Agent Central service\\n\", \"parameters\": {\"ContainerCeilometerCentralImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCeilometerConfigImage\": {\"description\": \"The container image to use for the ceilometer config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"CeilometerAgentCentralLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.ceilometer.agent.central\", \"file\": \"/var/log/containers/ceilometer/central.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}, \"MonitoringSubscriptionCeilometerCentral\": {\"default\": \"overcloud-ceilometer-agent-central\", \"type\": \"string\"}, \"CeilometerEnableGnocchi\": {\"default\": false, \"description\": \"Whether to enable gnocchi usage.\", \"type\": \"boolean\"}, \"CeilometerPassword\": {\"description\": \"The password for the ceilometer service account.\", \"type\": \"string\", \"hidden\": true}, \"CeilometerEnableTenantDiscovery\": {\"default\": false, \"description\": \"Identify user and project names from polled metrics.\", \"type\": \"boolean\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"CeilometerServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-base-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCeilometerCentralImage\": \"ContainerCeilometerCentralImage\", \"ContainerCeilometerConfigImage\": \"ContainerCeilometerConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCeilometerCentralImage\": {\"get_param\": \"ContainerCeilometerCentralImage\"}, \"ContainerCeilometerConfigImage\": {\"get_param\": \"ContainerCeilometerConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceilometer Agent Central role.\", \"value\": {\"service_name\": \"ceilometer_agent_central\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCeilometerCentral\"}, \"keystone_resources\": {\"ceilometer\": {\"users\": {\"ceilometer\": {\"password\": {\"get_param\": \"CeilometerPassword\"}, \"roles\": [\"admin\", \"ResellerAdmin\"]}}, \"roles\": [\"ResellerAdmin\"]}}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CeilometerServiceBase\", \"role_data\", \"config_settings\"]}, {\"ceilometer_redis_password\": {\"get_param\": \"RedisPassword\"}, \"central_namespace\": true, \"ceilometer::agent::polling::tenant_name_discovery\": {\"get_param\": \"CeilometerEnableTenantDiscovery\"}}]}, \"service_config_settings\": {\"map_merge\": [{\"get_attr\": [\"CeilometerServiceBase\", \"role_data\", \"service_config_settings\"]}, {\"rsyslog\": {\"tripleo_logging_sources_ceilometer_agent_central\": [{\"get_param\": \"CeilometerAgentCentralLoggingSource\"}]}}]}, \"puppet_config\": {\"config_volume\": \"ceilometer\", \"puppet_tags\": \"ceilometer_config\", \"step_config\": \"include tripleo::profile::base::ceilometer::agent::polling\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/ceilometer_agent_central.json\": {\"command\": \"/usr/bin/ceilometer-polling --polling-namespaces central --logfile /var/log/ceilometer/central.log\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}, \"/var/lib/kolla/config_files/ceilometer_agent_gnocchi_upgrade.json\": {\"command\": \"/usr/bin/bootstrap_host_exec ceilometer_agent_central su ceilometer -s /bin/bash -c 'for n in {1..10}; do /usr/bin/ceilometer-upgrade && exit 0 || sleep 30; done; exit 1'\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_3\": {\"ceilometer_init_log\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerCentralImage\"]}, \"net\": \"none\", \"user\": \"root\", \"command\": [\"/bin/bash\", \"-c\", \"chown -R ceilometer:ceilometer /var/log/ceilometer\"], \"volumes\": [\"/var/log/containers/ceilometer:/var/log/ceilometer:z\"]}}, \"step_4\": {\"ceilometer_agent_central\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerCentralImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ceilometer_agent_central.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/ceilometer:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/ceilometer:/var/log/ceilometer:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}, \"step_5\": {\"if\": [{\"get_param\": \"CeilometerEnableGnocchi\"}, {\"ceilometer_gnocchi_upgrade\": {\"start_order\": 99, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerCentralImage\"]}, \"net\": \"host\", \"detach\": false, \"privileged\": false, \"user\": \"root\", \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ceilometer_agent_gnocchi_upgrade.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/ceilometer:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/ceilometer:/var/log/ceilometer:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}]}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/ceilometer\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop ceilometer agent central container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"ceilometer_agent_central\"], \"tripleo_delegate_to\": \"{{ groups['ceilometer_agent_central'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-agent-notification-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Ceilometer Agent Notification service\\n\", \"parameters\": {\"ContainerCeilometerNotificationImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCeilometerConfigImage\": {\"description\": \"The container image to use for the ceilometer config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"CeilometerAgentNotificationLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.ceilometer.agent.notification\", \"file\": \"/var/log/containers/ceilometer/agent-notification.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionCeilometerNotification\": {\"default\": \"overcloud-ceilometer-agent-notification\", \"type\": \"string\"}, \"MetricsQdrPort\": {\"default\": 5666, \"description\": \"Service name or port number on which the qdrouterd will accept connections.\", \"type\": \"number\"}, \"CeilometerQdrPublishEvents\": {\"default\": false, \"description\": \"Whether to send events to MetricsQdr service.\", \"type\": \"boolean\"}, \"CeilometerQdrPublishMetrics\": {\"default\": false, \"description\": \"Whether to send telemetry data to MetricsQdr service.\", \"type\": \"boolean\"}, \"CeilometerQdrEventsConfig\": {\"default\": {\"driver\": \"amqp\", \"topic\": \"event\"}, \"description\": \"Configuration for notifier publisher for events.\", \"type\": \"json\"}, \"CeilometerQdrMetricsConfig\": {\"default\": {\"driver\": \"amqp\", \"topic\": \"metering\"}, \"description\": \"Configuration for notifier publisher for metrics.\", \"type\": \"json\"}, \"ManageEventPipeline\": {\"default\": true, \"description\": \"Whether to manage event_pipeline.yaml.\", \"type\": \"boolean\"}, \"EventPipelinePublishers\": {\"default\": [], \"description\": \"A list of publishers to put in event_pipeline.yaml. When the collector is used, override this with notifier:// publisher. Set ManageEventPipeline to true for override to take effect.\\n\", \"type\": \"comma_delimited_list\"}, \"ManagePipeline\": {\"default\": false, \"description\": \"Whether to manage pipeline.yaml.\", \"type\": \"boolean\"}, \"PipelinePublishers\": {\"default\": [], \"description\": \"A list of publishers to put in pipeline.yaml. When the collector is used, override this with notifier:// publisher. Set ManagePipeline to true for override to take effect.\\n\", \"type\": \"comma_delimited_list\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"CeilometerServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-base-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCeilometerNotificationImage\": \"ContainerCeilometerNotificationImage\", \"ContainerCeilometerConfigImage\": \"ContainerCeilometerConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCeilometerNotificationImage\": {\"get_param\": \"ContainerCeilometerNotificationImage\"}, \"ContainerCeilometerConfigImage\": {\"get_param\": \"ContainerCeilometerConfigImage\"}}}]}}}}, \"conditions\": {\"ceilometer_qdr_publish\": {\"or\": [{\"get_param\": \"CeilometerQdrPublishEvents\"}, {\"get_param\": \"CeilometerQdrPublishMetrics\"}]}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceilometer Agent Notification role.\", \"value\": {\"service_name\": \"ceilometer_agent_notification\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCeilometerNotification\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CeilometerServiceBase\", \"role_data\", \"config_settings\"]}, {\"ceilometer::agent::notification::manage_event_pipeline\": {\"get_param\": \"ManageEventPipeline\"}, \"ceilometer::agent::notification::manage_pipeline\": {\"get_param\": \"ManagePipeline\"}, \"tripleo::profile::base::ceilometer::agent::notification::notifier_enabled\": {\"get_param\": \"CeilometerQdrPublishMetrics\"}, \"tripleo::profile::base::ceilometer::agent::notification::notifier_events_enabled\": {\"get_param\": \"CeilometerQdrPublishEvents\"}, \"tripleo::profile::base::ceilometer::agent::notification::pipeline_publishers\": {\"get_param\": \"PipelinePublishers\"}, \"tripleo::profile::base::ceilometer::agent::notification::event_pipeline_publishers\": {\"get_param\": \"EventPipelinePublishers\"}, \"tripleo::profile::base::ceilometer::agent::notification::notifier_params\": {\"get_param\": \"CeilometerQdrMetricsConfig\"}, \"tripleo::profile::base::ceilometer::agent::notification::notifier_event_params\": {\"get_param\": \"CeilometerQdrEventsConfig\"}}, {\"if\": [\"ceilometer_qdr_publish\", {\"tripleo::profile::base::ceilometer::agent::notification::notifier_host_addr\": {\"str_replace\": {\"template\": \"%{hiera('$NETWORK')}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", {\"str_replace\": {\"template\": \"ROLENAMEMetricsQdrNetwork\", \"params\": {\"ROLENAME\": {\"get_param\": \"RoleName\"}}}}]}}}}, \"tripleo::profile::base::ceilometer::agent::notification::notifier_host_port\": {\"get_param\": \"MetricsQdrPort\"}}]}]}, \"service_config_settings\": {\"map_merge\": [{\"get_attr\": [\"CeilometerServiceBase\", \"role_data\", \"service_config_settings\"]}, {\"rsyslog\": {\"tripleo_logging_sources_ceilometer_agent_notification\": [{\"get_param\": \"CeilometerAgentNotificationLoggingSource\"}]}}]}, \"puppet_config\": {\"config_volume\": \"ceilometer\", \"puppet_tags\": \"ceilometer_config\", \"step_config\": \"include tripleo::profile::base::ceilometer::agent::notification\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/ceilometer_agent_notification.json\": {\"command\": \"/usr/bin/ceilometer-agent-notification --logfile /var/log/ceilometer/agent-notification.log\", \"config_files\": {\"list_concat\": [[{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]]}}}, \"docker_config\": {\"step_3\": {\"ceilometer_init_log\": {\"start_order\": 0, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerNotificationImage\"]}, \"net\": \"none\", \"user\": \"root\", \"command\": [\"/bin/bash\", \"-c\", \"chown -R ceilometer:ceilometer /var/log/ceilometer\"], \"volumes\": [\"/var/log/containers/ceilometer:/var/log/ceilometer:z\"]}}, \"step_4\": {\"ceilometer_agent_notification\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerNotificationImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ceilometer_agent_notification.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/ceilometer:/var/lib/kolla/config_files/src:ro\", \"/var/log/containers/ceilometer:/var/log/ceilometer:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/ceilometer\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}], \"external_upgrade_tasks\": [{\"when\": [\"step|int == 1\"], \"tags\": [\"never\", \"system_upgrade_transfer_data\", \"system_upgrade_stop_services\"], \"block\": [{\"name\": \"Stop ceilometer agent notification container\", \"import_role\": {\"name\": \"tripleo_container_stop\"}, \"vars\": {\"tripleo_containers_to_stop\": [\"ceilometer_agent_notification\"], \"tripleo_delegate_to\": \"{{ groups['ceilometer_agent_notification'] | difference(groups['excluded_overcloud']) }}\"}}]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-agent-compute-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Ceilometer Agent Compute service\\n\", \"parameters\": {\"ContainerCeilometerComputeImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerCeilometerConfigImage\": {\"description\": \"The container image to use for the ceilometer config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"MonitoringSubscriptionCeilometerCompute\": {\"default\": \"overcloud-ceilometer-agent-compute\", \"type\": \"string\"}, \"InstanceDiscoveryMethod\": {\"default\": \"libvirt_metadata\", \"description\": \"Method used to discover instances running on compute node\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"naive\", \"libvirt_metadata\", \"workload_partitioning\"]}]}, \"RedisPassword\": {\"description\": \"The password for the redis service account.\", \"type\": \"string\", \"hidden\": true}, \"CeilometerEnableTenantDiscovery\": {\"default\": false, \"description\": \"Identify user and project names from polled metrics.\", \"type\": \"boolean\"}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"CeilometerServiceBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/ceilometer/ceilometer-base-container-puppet.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerCeilometerComputeImage\": \"ContainerCeilometerComputeImage\", \"ContainerCeilometerConfigImage\": \"ContainerCeilometerConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerCeilometerComputeImage\": {\"get_param\": \"ContainerCeilometerComputeImage\"}, \"ContainerCeilometerConfigImage\": {\"get_param\": \"ContainerCeilometerConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceilometer Agent Compute role.\", \"value\": {\"service_name\": \"ceilometer_agent_compute\", \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionCeilometerCompute\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"CeilometerServiceBase\", \"role_data\", \"config_settings\"]}, {\"ceilometer::agent::polling::instance_discovery_method\": {\"get_param\": \"InstanceDiscoveryMethod\"}}, {\"ceilometer_redis_password\": {\"get_param\": \"RedisPassword\"}, \"compute_namespace\": true, \"ceilometer::agent::polling::tenant_name_discovery\": {\"get_param\": \"CeilometerEnableTenantDiscovery\"}}]}, \"service_config_settings\": {\"get_attr\": [\"CeilometerServiceBase\", \"role_data\", \"service_config_settings\"]}, \"puppet_config\": {\"config_volume\": \"ceilometer\", \"puppet_tags\": \"ceilometer_config\", \"step_config\": \"include tripleo::profile::base::ceilometer::agent::polling\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/ceilometer_agent_compute.json\": {\"command\": \"/usr/bin/ceilometer-polling --polling-namespaces compute --logfile /var/log/ceilometer/compute.log\", \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}]}}, \"docker_config\": {\"step_4\": {\"ceilometer_agent_compute\": {\"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerCeilometerComputeImage\"]}, \"net\": \"host\", \"privileged\": false, \"restart\": \"always\", \"depends_on\": [\"tripleo_nova_libvirt.target\"], \"healthcheck\": {\"test\": \"/openstack/healthcheck\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, [\"/var/lib/kolla/config_files/ceilometer_agent_compute.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/ceilometer:/var/lib/kolla/config_files/src:ro\", \"/run/libvirt:/run/libvirt:shared,z\", \"/var/log/containers/ceilometer:/var/log/ceilometer:z\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": [{\"name\": \"create persistent directories\", \"file\": {\"path\": \"{{ item.path }}\", \"state\": \"directory\", \"setype\": \"{{ item.setype }}\", \"mode\": \"{{ item.mode }}\"}, \"with_items\": [{\"path\": \"/var/log/containers/ceilometer\", \"setype\": \"container_file_t\", \"mode\": \"0750\"}]}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-base.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Ceph base service. Shared by all Ceph services.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NodeDataLookup\": {\"type\": \"json\", \"default\": {}, \"description\": \"json containing per-node configuration map\"}, \"DeploymentServerBlacklist\": {\"default\": [], \"type\": \"comma_delimited_list\", \"description\": \"List of server hostnames to blacklist from any triggered deployments.\\n\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"CephEnableDashboard\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Parameter used to trigger the dashboard deployment.\"}, \"CephConfigOverrides\": {\"type\": \"json\", \"description\": \"Extra config settings to dump into ceph.conf\", \"default\": {}}, \"ApplyCephConfigOverridesOnUpdate\": {\"type\": \"boolean\", \"default\": false, \"description\": \"If true, CephConfigOverrides are applied to the Ceph cluster not only during the initial deployment but also during each update.\\n\"}, \"CephClusterFSID\": {\"type\": \"string\", \"description\": \"The Ceph cluster FSID. Must be a UUID.\"}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephMsgrSecureMode\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Enable Ceph msgr2 secure mode to enable on-wire encryption between Ceph daemons and also between Ceph clients and daemons.\\n\"}, \"CephPools\": {\"description\": \"Used to override settings (mainly target_size_ratio or pg_num) in pools. Pacific has pg_autoscale_mode enabled by default so set target_size_ratio as a percentage of the expected data consumption. The example below sets cinder volumes 40%, glance images 10%, nova vms 30% (20% of space free). Not set by default but overrides are encouraged to avoid data rebalancing. For example, CephPools:\\n  - name: volumes\\n    target_size_ratio: 0.4\\n    application: rbd\\n  - name: images\\n    target_size_ratio: 0.1\\n    application: rbd\\n  - name: vms\\n    target_size_ratio: 0.3\\n    application: rbd\\n\", \"default\": [], \"type\": \"json\"}, \"CinderRbdPoolName\": {\"default\": \"volumes\", \"type\": \"string\"}, \"CinderRbdExtraPools\": {\"default\": [], \"description\": \"List of extra Ceph pools for use with RBD backends for Cinder. An extra Cinder RBD backend driver is created for each pool in the list. This is in addition to the standard RBD backend driver associated with the CinderRbdPoolName.\\n\", \"type\": \"comma_delimited_list\"}, \"CinderBackupRbdPoolName\": {\"default\": \"backups\", \"type\": \"string\"}, \"GlanceMultistoreConfig\": {\"type\": \"json\", \"default\": {}, \"description\": \"Dictionary of settings when configuring additional glance backends. The\\nhash key is the backend ID, and the value is a dictionary of parameter\\nvalues unique to that backend. Multiple rbd and cinder backends are allowed, but\\nfile and swift backends are limited to one each. Example:\\n  # Default glance store is rbd.\\n  GlanceBackend: rbd\\n  GlanceStoreDescription: 'Default rbd store'\\n  # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder\\n  # backend.\\n  GlanceMultistoreConfig:\\n    rbd2_store:\\n      GlanceBackend: rbd\\n      GlanceStoreDescription: 'Second rbd store'\\n      CephClusterName: ceph2\\n      # Override CephClientUserName if this cluster uses a different\\n      # client name.\\n      CephClientUserName: client2\\n    cinder1_store:\\n      GlanceBackend: cinder\\n      GlanceCinderVolumeType: 'volume-type-1'\\n      GlanceStoreDescription: 'First cinder store'\\n    cinder2_store:\\n      GlanceBackend: cinder\\n      GlanceCinderVolumeType: 'volume-type-2'\\n      GlanceStoreDescription: 'Seconde cinder store'\\n\"}, \"GlanceRbdPoolName\": {\"default\": \"images\", \"type\": \"string\"}, \"GlanceBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Glance backend to use. Should be one of swift, rbd, cinder, or file\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"file\", \"rbd\", \"cinder\"]}]}, \"GnocchiRbdPoolName\": {\"default\": \"metrics\", \"type\": \"string\"}, \"NovaRbdPoolName\": {\"default\": \"vms\", \"type\": \"string\", \"description\": \"The pool name for RBD backend ephemeral storage.\", \"tags\": [\"role_specific\"]}, \"CephClientKey\": {\"description\": \"The Ceph client key. Can be created with ceph-authtool --gen-print-key.\", \"type\": \"string\", \"hidden\": true, \"constraints\": [{\"allowed_pattern\": \"^[a-zA-Z0-9+/]{38}==$\"}]}, \"CephClientUserName\": {\"default\": \"openstack\", \"type\": \"string\"}, \"CephRgwClientName\": {\"default\": \"radosgw\", \"type\": \"string\"}, \"CephRgwKey\": {\"description\": \"The cephx key for the radosgw client. Can be created with ceph-authtool --gen-print-key.\", \"type\": \"string\", \"hidden\": true, \"constraints\": [{\"allowed_pattern\": \"^[a-zA-Z0-9+/]{38}==$\"}]}, \"ManilaCephFSDataPoolName\": {\"default\": \"manila_data\", \"type\": \"string\"}, \"ManilaCephFSMetadataPoolName\": {\"default\": \"manila_metadata\", \"type\": \"string\"}, \"ManilaCephFSShareBackendName\": {\"default\": \"cephfs\", \"type\": \"string\"}, \"ManilaCephFSCephFSAuthId\": {\"default\": \"manila\", \"type\": \"string\"}, \"CephManilaClientKey\": {\"default\": \"\", \"description\": \"The Ceph client key. Can be created with ceph-authtool --gen-print-key.\", \"type\": \"string\", \"hidden\": true, \"constraints\": [{\"allowed_pattern\": \"^[a-zA-Z0-9+/]{38}==$\"}]}, \"CephIPv6\": {\"default\": false, \"type\": \"boolean\"}, \"SwiftPassword\": {\"description\": \"The password for the swift service account\", \"type\": \"string\", \"hidden\": true}, \"ContainerCephDaemonImage\": {\"description\": \"image\", \"type\": \"string\"}, \"CephAnsiblePlaybookVerbosity\": {\"default\": 1, \"description\": \"The number of '-v', '-vv', etc. passed to ansible-playbook command\", \"type\": \"number\", \"constraints\": [{\"range\": {\"min\": 1, \"max\": 5}}]}, \"CephAnsibleEnvironmentVariables\": {\"default\": {}, \"description\": \"Mapping of Ansible environment variables to override defaults.\", \"type\": \"json\"}, \"SwiftFetchDirGetTempurl\": {\"default\": \"\", \"description\": \"A temporary Swift URL to download the fetch_directory from.\", \"type\": \"string\"}, \"SwiftFetchDirPutTempurl\": {\"default\": \"\", \"description\": \"A temporary Swift URL to upload the fetch_directory to.\", \"type\": \"string\"}, \"LocalCephAnsibleFetchDirectoryBackup\": {\"default\": \"\", \"description\": \"Filesystem path on undercloud to persist a copy of the data from the ceph-ansible fetch directory. Used as an alternative to backing up the fetch_directory in Swift. Path must be writable and readable by the user running ansible from config-download, e.g. the mistral user in the mistral-executor container is able to read/write to /var/lib/mistral/ceph_fetch\", \"type\": \"string\"}, \"CephOsdPercentageMin\": {\"default\": 0, \"description\": \"The minimum percentage of Ceph OSDs which must be running and in the Ceph cluster, according to ceph osd stat, for the deployment not to fail. Used to catch deployment errors early. Set this value to 0 to disable this check. Deprecated in Wallaby because of the move from ceph-ansible to cephadm; the later only brings up OSDs out of band and deployment does not block while waiting for them to come up, thus we cannot do this anymore.\", \"type\": \"number\"}, \"CephAnsiblePlaybook\": {\"type\": \"comma_delimited_list\", \"description\": \"List of paths to the ceph-ansible playbooks to execute. If not specified, the playbook will be determined automatically depending on type of operation being performed (deploy/update/upgrade).\\n\", \"default\": [\"default\"]}, \"CephAnsibleExtraConfig\": {\"type\": \"json\", \"description\": \"Extra vars for the ceph-ansible playbook\", \"default\": {}}, \"CephAnsibleSkipTags\": {\"type\": \"string\", \"description\": \"List of ceph-ansible tags to skip\", \"default\": \"package-install,with_pkg\"}, \"CephAnsibleRepo\": {\"type\": \"string\", \"description\": \"The repository that should be used to install the right ceph-ansible\\npackage. This value can be used by tripleo-validations to double check\\nthe right ceph-ansible version is installed.\\n\", \"default\": \"centos-ceph-nautilus\"}, \"CephAnsibleWarning\": {\"type\": \"boolean\", \"description\": \"In particular scenarios we want this validation to show the warning but\\ndon't fail because the package is installed on the system but repos are\\ndisabled.\\n\", \"default\": true}, \"CephPoolDefaultPgNum\": {\"description\": \"default pg_num to use for the RBD pools\", \"type\": \"number\", \"default\": 16}, \"CephPoolDefaultSize\": {\"description\": \"default minimum replication for RBD copies\", \"type\": \"number\", \"default\": 3}, \"ContainerImageRegistryCredentials\": {\"type\": \"json\", \"hidden\": true, \"description\": \"Mapping of image registry hosts to login credentials. Must be in the following example format\\n\\n  docker.io:\\n    username: pa55word\\n  '192.0.2.1:8787':\\n    registry_username: password\\n\", \"default\": {}}, \"CephExtraKeys\": {\"type\": \"json\", \"hidden\": true, \"description\": \"List of maps describing extra keys which will be created on the deployed\\nCeph cluster. Uses ceph-ansible/library/ceph_key.py ansible module. Each\\nitem in the list must be in the following example format\\n  - name: \\\"client.glance\\\"\\n    caps:\\n      mgr: \\\"allow *\\\"\\n      mon: \\\"profile rbd\\\"\\n      osd: \\\"profile rbd pool=images\\\"\\n    key: \\\"AQBRgQ9eAAAAABAAv84zEilJYZPNuJ0Iwn9Ndg==\\\"\\n    mode: \\\"0600\\\"\\n\", \"default\": []}, \"CinderEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable or not the Rbd backend for Cinder\", \"type\": \"boolean\"}, \"NovaEnableRbdBackend\": {\"default\": false, \"description\": \"Whether to enable the Rbd backend for Nova ephemeral storage.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"CinderBackupBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Cinder Backup backend to use.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"ceph\", \"nfs\", \"gcs\", \"s3\"]}]}, \"GnocchiBackend\": {\"default\": \"swift\", \"description\": \"The short name of the Gnocchi backend to use. Should be one of swift, rbd, file or s3.\", \"type\": \"string\", \"constraints\": [{\"allowed_values\": [\"swift\", \"file\", \"rbd\", \"s3\"]}]}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"CephClientConfigVars\": {\"default\": \"{{ playbook_dir }}/cephadm/ceph_client.yml\", \"type\": \"string\", \"description\": \"The undercloud path where cephadm exports the Ceph Client configuration.\"}, \"CephAnsibleSkipClient\": {\"description\": \"This boolean (when true) prevents the ceph-ansible client role execution\\nby adding the ceph-ansible tag 'ceph_client' to the --skip-tags list.\\n\", \"type\": \"boolean\", \"default\": true}, \"CephDynamicSpec\": {\"type\": \"boolean\", \"default\": true, \"description\": \"If true the tripleo_run_cephadm role will build an orchestrator-cli-service-spec\\nfile based on the data found in the inventory (which is based on composable roles)\\nby using the ceph_spec_bootstrap Ansible module in tripleo-ansible.\\n\"}, \"CephSpecPath\": {\"default\": \"{{ playbook_dir }}/cephadm/ceph_spec.yaml\", \"type\": \"string\", \"description\": \"The path on the undercloud to a valid Ceph orchestrator CLI service spec file.\\nIf you do not want the spec to be generated automatically and instead prefer\\nto supply your own spec, then place your spec at this path on the undercloud\\nand set CephDynamicSpec to false. If CephDynamicSpec is true and CephSpecPath\\nis set to a valid path, then the spec will be created at that path before it\\nis used to deploy Ceph. By default the spec will be created by config-download\\nin config-download/<stack>/cephadm/ceph_spec.yaml.\\n\"}, \"CephOsdSpec\": {\"description\": \"If CephDynamicSpec is true, then any valid OSD service specification set in\\nCephOsdSpec will appear in the genereated Ceph spec for the 'osd' service_type.\\nReplaces CephAnsibleDisksConfig. This parameter has no effect if CephDynamicSpec\\nis false. Use this paramter to override the default of using all available block\\ndevices as data_devices. See the Ceph documentation for cephadm drivegroups.\\nExclude service_type, service_id, and placement from this parameter. In the\\nexample below all rotating devices will be data devices and all non-rotating\\ndevices will be used as shared devices (wal, db).\\n  CephOsdSpec:\\n    data_devices:\\n      rotational: 1\\n    db_devices:\\n      rotational: 0\\n\", \"type\": \"json\", \"default\": {\"data_devices\": {\"all\": true}}}, \"CephSpecFqdn\": {\"default\": false, \"type\": \"boolean\", \"description\": \"If both CephDynamicSpec and CephSpecFqdn are true, then the hostname and\\nhosts of the generated Ceph spec will have their fully qualified domain\\nname instead of their short hostname. This parameter has no effect if\\nCephDynamicSpec is false.\\n\"}, \"CephCrushRules\": {\"type\": \"json\", \"description\": \"List of rules describing the device classes that will be found on the deployed\\nCeph cluster. They can be specified in the following form\\n- name: HDD\\n  root: default\\n  type: host\\n  class: hdd\\n  default: true\\n\", \"default\": []}, \"CephAdmDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"If this parameter is true, then cephadm sets the debug related mgr\\nconfig-key and produces a more verbose output.\\n\"}, \"CephAdmVerbose\": {\"type\": \"boolean\", \"default\": false, \"description\": \"If this parameter is true, the cephadm playbook is able to print\\nsome ceph related information during its execution.\\n\"}, \"DeployedCeph\": {\"default\": false, \"type\": \"boolean\", \"description\": \"If the Ceph cluster has already been deployed but needs to be configured\\nso that the overcloud can use it (create cephx keys, pools, configure RGW\\nwith haproxy, etc), then this parameter should be set to true. Set this\\nparameter to false to have cephadm deploy the ceph cluster during overcloud\\ndeployment. DeployedCeph and CephDynamicSpec are mutually exclusive.\\n\"}, \"DisableCephadm\": {\"default\": false, \"type\": \"boolean\", \"description\": \"Disable cephadm after Ceph is deployed\"}, \"CephRbdTrashPurgeInterval\": {\"default\": 15, \"type\": \"string\", \"description\": \"The interval applied to the rbd trash purge scheduler, that can be\\nexpressed in minutes.\\n\"}, \"CephRbdTrashSchedulerEnable\": {\"default\": false, \"type\": \"boolean\", \"description\": \"Enable Ceph rbd trash scheduler\"}, \"CephadmDefaultContainer\": {\"default\": false, \"type\": \"boolean\", \"description\": \"Use the default continer defined in cephadm instead of\\nthe one defined in container_image_prepare_defaults.yaml.\\n\"}, \"ExternalCeph\": {\"default\": false, \"type\": \"boolean\", \"description\": \"If the Ceph cluster has been deployed outside of TripleO.\\nDeployedCeph and ExternalCeph are mutually exclusive.\\n\"}}, \"parameter_groups\": [{\"label\": \"deprecated\", \"description\": \"Do not use deprecated params, they will be removed.\", \"parameters\": [\"LocalCephAnsibleFetchDirectoryBackup\", \"SwiftFetchDirGetTempurl\", \"SwiftFetchDirPutTempurl\", \"CephIPv6\", \"CephAnsibleEnvironmentVariables\", \"CephAnsibleExtraConfig\", \"CephAnsiblePlaybook\", \"CephAnsiblePlaybookVerbosity\", \"CephAnsibleRepo\", \"CephAnsibleSkipTags\", \"CephAnsibleSkipClient\", \"CephAnsibleWarning\", \"CephOsdPercentageMin\", \"CephPoolDefaultPgNum\", \"CephPoolDefaultSize\"]}], \"conditions\": {\"custom_registry_host\": {\"yaql\": {\"data\": {\"get_param\": \"ContainerCephDaemonImage\"}, \"expression\": \"$.data.split('/')[0].matches('(\\\\.|:)')\"}}, \"ceph_authenticated_registry\": {\"and\": [{\"not\": {\"yaql\": {\"data\": {\"cred\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"ns\": {\"yaql\": {\"expression\": \"let(location => $.data.rightSplit(':', 1)[0]) -> regex('(?:https?://)?(.*?)/(.*)').split($location)[1]\", \"data\": {\"get_param\": \"ContainerCephDaemonImage\"}}}}, \"expression\": \"let(c => $.data.cred) -> $c.get($.data.ns, {}).keys().last(default => \\\"\\\").isEmpty()\"}}}, {\"not\": {\"yaql\": {\"data\": {\"cred\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"ns\": {\"yaql\": {\"expression\": \"let(location => $.data.rightSplit(':', 1)[0]) -> regex('(?:https?://)?(.*?)/(.*)').split($location)[1]\", \"data\": {\"get_param\": \"ContainerCephDaemonImage\"}}}}, \"expression\": \"let(c => $.data.cred) -> $c.get($.data.ns, {}).values().last(default => \\\"\\\").isEmpty()\"}}}]}}, \"resources\": {\"ContainerImageUrlParts\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"host\": {\"if\": [\"custom_registry_host\", {\"yaql\": {\"expression\": \"let(location => $.data.rightSplit(':', 1)[0]) -> regex('(?:https?://)?(.*?)/(.*)').split($location)[1]\", \"data\": {\"get_param\": \"ContainerCephDaemonImage\"}}}, \"docker.io\"]}, \"image\": {\"if\": [\"custom_registry_host\", {\"yaql\": {\"expression\": \"let(location => $.data.rightSplit(':', 1)[0]) -> regex('(?:https?://)?(.*?)/(.*)').split($location)[2]\", \"data\": {\"get_param\": \"ContainerCephDaemonImage\"}}}, {\"yaql\": {\"expression\": \"$.data.rightSplit(':', 1)[0]\", \"data\": {\"get_param\": \"ContainerCephDaemonImage\"}}}]}, \"image_tag\": {\"yaql\": {\"expression\": \"$.data.rightSplit(':', 1)[1]\", \"data\": {\"get_param\": \"ContainerCephDaemonImage\"}}}}}}, \"DefaultCephConfigOverrides\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"vars\": {}}}}, \"CephAdmVars\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"vars\": {\"tripleo_cephadm_fsid\": {\"get_param\": \"CephClusterFSID\"}, \"tripleo_cephadm_cluster\": {\"get_param\": \"CephClusterName\"}, \"tripleo_cephadm_container_cli\": {\"get_param\": \"ContainerCli\"}, \"tripleo_ceph_client_vars\": {\"get_param\": \"CephClientConfigVars\"}, \"tripleo_cephadm_dashboard_enabled\": {\"get_param\": \"CephEnableDashboard\"}, \"cephfs\": {\"get_param\": \"ManilaCephFSShareBackendName\"}, \"tripleo_cephadm_container_ns\": {\"get_attr\": [\"ContainerImageUrlParts\", \"value\", \"host\"]}, \"tripleo_cephadm_container_image\": {\"get_attr\": [\"ContainerImageUrlParts\", \"value\", \"image\"]}, \"tripleo_cephadm_container_tag\": {\"get_attr\": [\"ContainerImageUrlParts\", \"value\", \"image_tag\"]}, \"tripleo_cephadm_crush_rules\": {\"get_param\": \"CephCrushRules\"}, \"tripleo_cephadm_debug\": {\"get_param\": \"CephAdmDebug\"}, \"tripleo_cephadm_verbose\": {\"get_param\": \"CephAdmVerbose\"}, \"tripleo_cephadm_rbd_trash\": {\"get_param\": \"CephRbdTrashPurgeInterval\"}, \"tripleo_cephadm_enable_trash_scheduler\": {\"get_param\": \"CephRbdTrashSchedulerEnable\"}, \"tripleo_cephadm_apply_ceph_conf_overrides_on_update\": {\"get_param\": \"ApplyCephConfigOverridesOnUpdate\"}, \"tripleo_cephadm_default_container\": {\"get_param\": \"CephadmDefaultContainer\"}, \"ceph_container_registry_auth\": {\"if\": [\"ceph_authenticated_registry\", true, false]}, \"ceph_container_registry_username\": {\"yaql\": {\"data\": {\"cred\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"ns\": {\"get_attr\": [\"ContainerImageUrlParts\", \"value\", \"host\"]}}, \"expression\": \"let(c => $.data.cred) -> $c.get($.data.ns, {}).keys().last(default => \\\"\\\")\"}}, \"ceph_container_registry_password\": {\"yaql\": {\"data\": {\"cred\": {\"get_param\": \"ContainerImageRegistryCredentials\"}, \"ns\": {\"get_attr\": [\"ContainerImageUrlParts\", \"value\", \"host\"]}}, \"expression\": \"let(c => $.data.cred) -> $c.get($.data.ns, {}).values().last(default => \\\"\\\")\"}}, \"public_network\": {\"list_join\": [\",\", {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"CephMonNetwork\"]}]}]}, \"cluster_network\": {\"list_join\": [\",\", {\"get_param\": [\"ServiceData\", \"net_cidr_map\", {\"get_param\": [\"ServiceNetMap\", \"CephClusterNetwork\"]}]}]}}}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceph base service.\", \"value\": {\"service_name\": \"ceph_base\", \"upgrade_tasks\": [], \"puppet_config\": {}, \"docker_config\": {}, \"config_settings\": {}, \"external_deploy_tasks\": [{\"name\": \"ceph_base_external_deploy_task\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"create cephadm working directory and related files\", \"include_role\": {\"name\": \"tripleo_run_cephadm\", \"tasks_from\": \"prepare.yml\"}, \"vars\": {\"ceph_pools\": {\"gnocchi_pool\": {\"name\": {\"get_param\": \"GnocchiRbdPoolName\"}, \"enabled\": {\"if\": [{\"equals\": [{\"get_param\": \"GnocchiBackend\"}, \"rbd\"]}, true, false]}}, \"nova_pool\": {\"name\": {\"get_param\": \"NovaRbdPoolName\"}, \"enabled\": {\"get_param\": \"NovaEnableRbdBackend\"}}, \"glance_pool\": {\"name\": {\"get_param\": \"GlanceRbdPoolName\"}, \"enabled\": {\"or\": [{\"yaql\": {\"data\": {\"get_param\": \"GlanceMultistoreConfig\"}, \"expression\": \"$.data.values().where($ != null).GlanceBackend.contains(\\\"rbd\\\")\"}}, {\"equals\": [{\"get_param\": \"GlanceBackend\"}, \"rbd\"]}]}}, \"cinder_pool\": {\"name\": {\"get_param\": \"CinderRbdPoolName\"}, \"enabled\": {\"get_param\": \"CinderEnableRbdBackend\"}, \"cinder_extra_pools\": {\"get_param\": \"CinderRbdExtraPools\"}}, \"cinder_backup_pool\": {\"name\": {\"get_param\": \"CinderBackupRbdPoolName\"}, \"enabled\": {\"if\": [{\"equals\": [{\"get_param\": \"CinderBackupBackend\"}, \"ceph\"]}, true, false]}}, \"extra_pools\": {\"get_param\": \"CephPools\"}}, \"manila_pools\": {\"data\": {\"get_param\": \"ManilaCephFSDataPoolName\"}, \"metadata\": {\"get_param\": \"ManilaCephFSMetadataPoolName\"}}, \"ceph_keys\": {\"openstack_client\": {\"name\": {\"get_param\": \"CephClientUserName\"}, \"key\": {\"get_param\": \"CephClientKey\"}}, \"manila\": {\"name\": {\"get_param\": \"ManilaCephFSCephFSAuthId\"}, \"key\": {\"get_param\": \"CephManilaClientKey\"}}, \"radosgw\": {\"name\": {\"get_param\": \"CephRgwClientName\"}, \"key\": {\"get_param\": \"CephRgwKey\"}}, \"extra_keys\": {\"get_param\": \"CephExtraKeys\"}}, \"ceph_config_overrides\": {\"get_param\": \"CephConfigOverrides\"}, \"tripleo_run_cephadm_spec_path\": {\"get_param\": \"CephSpecPath\"}, \"tripleo_cephadm_dynamic_spec\": {\"get_param\": \"CephDynamicSpec\"}, \"ceph_spec_fqdn\": {\"get_param\": \"CephSpecFqdn\"}, \"ceph_osd_spec\": {\"get_param\": \"CephOsdSpec\"}, \"ceph_default_overrides\": {\"global\": {\"if\": [{\"get_param\": \"CephMsgrSecureMode\"}, {\"map_merge\": [{\"get_attr\": [\"DefaultCephConfigOverrides\", \"value\", \"vars\"]}, {\"ms_cluster_mode\": \"secure\", \"ms_service_mode\": \"secure\", \"ms_client_mode\": \"secure\"}]}, {\"get_attr\": [\"DefaultCephConfigOverrides\", \"value\", \"vars\"]}]}}, \"cephadm_extra_vars\": {\"get_attr\": [\"CephAdmVars\", \"value\", \"vars\"]}, \"tripleo_cephadm_deployed_ceph\": {\"get_param\": \"DeployedCeph\"}}}, {\"name\": \"Prepare cephadm user and keys\", \"include_role\": {\"name\": \"tripleo_run_cephadm\", \"tasks_from\": \"enable_ceph_admin_user.yml\"}, \"when\": [\"not external_ceph\", \"(not deployed_ceph and (groups['ceph_mon'] | default([]) | length > 0 or groups['ceph_nfs'] | default([]) | length > 0)) or (deployed_ceph and ((groups['ceph_rgw'] | default([]) != groups['ceph_mon'] | default([]) and groups['ceph_rgw'] | default([]) | length > 0) or (groups['ceph_mds'] | default([]) != groups['ceph_mon'] | default([]) and groups['ceph_mds'] | default([]) | length > 0) or (groups['ceph_nfs'] | default([]) != groups['ceph_mon'] | default([]) and groups['ceph_nfs'] | default([]) | length > 0) or (groups['ceph_rbdmirror'] | default([]) != groups['ceph_mon'] | default([]) and groups['ceph_rbdmirror'] | default([]) | length > 0)))\"], \"vars\": {\"deployed_ceph\": {\"get_param\": \"DeployedCeph\"}, \"external_ceph\": {\"get_param\": \"ExternalCeph\"}}}, {\"name\": \"Deploy or configure the cephadm Ceph cluster\", \"include_role\": {\"name\": \"tripleo_run_cephadm\"}, \"when\": [\"not external_ceph\", \"groups['ceph_mon'] | default([]) | length > 0 or groups['ceph_nfs'] | default([]) | length > 0\"], \"vars\": {\"external_ceph\": {\"get_param\": \"ExternalCeph\"}}}]}, {\"name\": \"ceph_base_external_deploy_task\", \"when\": [\"(step | int) == 3\", {\"get_param\": \"DisableCephadm\"}, \"not external_ceph\"], \"block\": [{\"name\": \"Pause cephadm\", \"include_role\": {\"name\": \"tripleo_run_cephadm\", \"tasks_from\": \"disable_cephadm.yml\"}}], \"vars\": {\"external_ceph\": {\"get_param\": \"ExternalCeph\"}}}], \"post_upgrade_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-client.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Ceph Client service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephExternalMultiConfig\": {\"type\": \"json\", \"hidden\": true, \"description\": \"List of maps describing extra overrides which will be applied when configuring\\nextra external Ceph clusters. If this list is non-empty, ceph-ansible will run\\nan extra count(list) times using the same parameters as the first run except\\neach parameter within each map will override the defaults. If the following\\nwere used, the second run would configure the overcloud to also use the ceph2\\ncluster with all the previous parameters except /etc/ceph/ceph2.conf would have\\na mon_host entry containing the value of external_cluster_mon_ips below, and\\nnot the default CephExternalMonHost. Subsequent ceph-ansible runs are restricted\\nto just ceph clients. CephExternalMultiConfig may not be used to deploy additional\\ninternal Ceph clusters within one Heat stack. The map for each list should contain\\nnot tripleo-heat-template parameters but ceph-ansible parameters.\\n  - cluster: 'ceph2'\\n    fsid: 'e2cba068-5f14-4b0f-b047-acf375c0004a'\\n    external_cluster_mon_ips: '172.18.0.5,172.18.0.6,172.18.0.7'\\n    keys:\\n      - name: \\\"client.openstack\\\"\\n        caps:\\n          mgr: \\\"allow *\\\"\\n          mon: \\\"profile rbd\\\"\\n          osd: \\\"osd: profile rbd pool=volumes, profile rbd pool=backups, profile rbd pool=vms, profile rbd pool=images\\\"\\n        key: \\\"AQCwmeRcAAAAABAA6SQU/bGqFjlfLro5KxrB1Q==\\\"\\n        mode: \\\"0600\\\"\\n    dashboard_enabled: false\\n\", \"default\": []}, \"CephConfigPath\": {\"type\": \"string\", \"default\": \"/var/lib/tripleo-config/ceph\", \"description\": \"The path where the Ceph Cluster config files are stored on the host.\\n\"}, \"CephClientConfigVars\": {\"default\": \"{{ playbook_dir }}/cephadm/ceph_client.yml\", \"type\": \"string\", \"description\": \"The undercloud path where cephadm exports the Ceph Client configuration.\"}, \"CephClusterFSID\": {\"type\": \"string\", \"description\": \"The Ceph cluster FSID. Must be a UUID.\"}, \"CephExternalMonHost\": {\"default\": \"\", \"type\": \"string\", \"description\": \"List of externally managed Ceph Mon Host IPs. Only used for external Ceph deployments.\"}}, \"resources\": {\"CephBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"DefaultPasswords\": {\"get_param\": \"DefaultPasswords\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceph Client service.\", \"value\": {\"service_name\": \"ceph_client\", \"upgrade_tasks\": [], \"puppet_config\": {}, \"docker_config\": {}, \"external_deploy_tasks\": {\"list_concat\": [{\"get_attr\": [\"CephBase\", \"role_data\", \"external_deploy_tasks\"]}, [{\"name\": \"ceph_base_external_deploy_init\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Set some tripleo-ansible facts\", \"set_fact\": {\"ceph_external_multi_config\": {\"get_param\": \"CephExternalMultiConfig\"}}}]}, {\"name\": \"Configure Ceph Clients\", \"when\": \"step|int == 2\", \"block\": [{\"name\": \"Check if the input variable file exists\", \"stat\": {\"path\": \"{{ tripleo_ceph_client_vars }}\"}, \"register\": \"ceph_input_vars\", \"vars\": {\"tripleo_ceph_client_vars\": {\"get_param\": \"CephClientConfigVars\"}}}, {\"name\": \"Populate CephClientConfigVars from THT\", \"copy\": {\"dest\": \"{{ tripleo_ceph_client_vars }}\", \"content\": \"tripleo_ceph_client_fsid: \\\"{{ tripleo_ceph_client_fsid }}\\\"\\nexternal_cluster_mon_ips: \\\"{{ external_cluster_mon_ips }}\\\"\\n\"}, \"when\": [\"ceph_input_vars.stat.exists == False\", \"external_cluster_mon_ips | length > 0\"], \"vars\": {\"tripleo_ceph_client_vars\": {\"get_param\": \"CephClientConfigVars\"}, \"tripleo_ceph_client_fsid\": {\"get_param\": \"CephClusterFSID\"}, \"external_cluster_mon_ips\": {\"get_param\": \"CephExternalMonHost\"}}}, {\"name\": \"configure ceph clients\", \"include_role\": {\"name\": \"tripleo_ceph_client\"}, \"vars\": {\"tripleo_ceph_client_config_home\": {\"get_param\": \"CephConfigPath\"}, \"tripleo_ceph_client_vars\": {\"get_param\": \"CephClientConfigVars\"}}}, {\"include_role\": {\"name\": \"tripleo_ceph_client\"}, \"name\": \"tripleo client role\", \"vars\": {\"tripleo_ceph_client_config_home\": {\"get_param\": \"CephConfigPath\"}, \"multiple\": \"{{ item }}\"}, \"loop\": \"{{ ceph_external_multi_config }}\", \"when\": [\"ceph_external_multi_config is defined\"]}, {\"name\": \"Load variables for standalone ganesha\", \"include_vars\": \"{{ playbook_dir }}/cephadm/cephadm-extra-vars-heat.yml\", \"when\": [\"groups['ceph_mon'] | default([]) | length == 0\", \"groups['ceph_nfs'] | default([]) | length > 0\"]}, {\"name\": \"Config Standalone Ganesha\", \"include_role\": {\"name\": \"tripleo_cephadm\", \"tasks_from\": \"nfs\"}, \"when\": [\"groups['ceph_mon'] | default([]) | length == 0\", \"groups['ceph_nfs'] | default([]) | length > 0\"], \"vars\": {\"tripleo_cephadm_config_home\": {\"get_param\": \"CephConfigPath\"}}}]}]]}, \"external_update_tasks\": [], \"external_upgrade_tasks\": [], \"config_settings\": {}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-mgr.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Ceph Manager service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephDashboardAdminUser\": {\"default\": \"admin\", \"description\": \"Admin user for the dashboard component\", \"type\": \"string\"}, \"CephDashboardAdminPassword\": {\"description\": \"Admin password for the dashboard component\", \"type\": \"string\", \"hidden\": true}, \"CephEnableDashboard\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Parameter used to trigger the dashboard deployment.\"}, \"CephDashboardPort\": {\"type\": \"number\", \"default\": 8444, \"description\": \"Parameter that defines the ceph dashboard port.\"}, \"CephDashboardAdminRO\": {\"type\": \"boolean\", \"default\": true, \"description\": \"Parameter used to set a read-only admin user.\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"CephCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"conditions\": {\"internal_tls_enabled\": {\"and\": [{\"get_param\": \"CephEnableDashboard\"}, {\"get_param\": \"EnableInternalTLS\"}]}, \"key_size_override_set\": {\"not\": {\"equals\": [{\"get_param\": \"CephCertificateKeySize\"}, \"\"]}}}, \"resources\": {\"CephBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"DefaultPasswords\": {\"get_param\": \"DefaultPasswords\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"CephMgrAnsibleVars\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"vars\": {\"tripleo_cephadm_dashboard_admin_user\": {\"get_param\": \"CephDashboardAdminUser\"}, \"tripleo_cephadm_dashboard_admin_password\": {\"get_param\": \"CephDashboardAdminPassword\"}, \"tripleo_cephadm_dashboard_port\": {\"get_param\": \"CephDashboardPort\"}, \"tripleo_cephadm_dashboard_admin_user_ro\": {\"get_param\": \"CephDashboardAdminRO\"}, \"tripleo_cephadm_dashboard_protocol\": {\"if\": [\"internal_tls_enabled\", \"https\", \"http\"]}}}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceph Manager service.\", \"value\": {\"service_name\": \"ceph_mgr\", \"firewall_rules\": {\"113 ceph_mgr\": {\"dport\": {\"list_concat\": [[\"6800-7300\"], {\"if\": [{\"get_param\": \"CephEnableDashboard\"}, [{\"get_param\": \"CephDashboardPort\"}]]}]}}}, \"firewall_frontend_rules\": {\"if\": [{\"get_param\": \"CephEnableDashboard\"}, {\"100 ceph_dashboard\": {\"dport\": [{\"get_param\": \"CephDashboardPort\"}]}}]}, \"upgrade_tasks\": [], \"puppet_config\": {}, \"docker_config\": {}, \"external_deploy_tasks\": {\"list_concat\": [{\"get_attr\": [\"CephBase\", \"role_data\", \"external_deploy_tasks\"]}, {\"if\": [{\"get_param\": \"CephEnableDashboard\"}, [{\"name\": \"set tripleo-ansible ceph dashboard vars\", \"when\": \"step|int == 1\", \"set_fact\": {\"ceph_dashboard_vars\": {\"if\": [\"internal_tls_enabled\", {\"map_merge\": [{\"get_attr\": [\"CephMgrAnsibleVars\", \"value\", \"vars\"]}, {\"tripleo_cephadm_dashboard_crt\": \"/etc/pki/tls/certs/ceph_dashboard.crt\"}, {\"tripleo_cephadm_dashboard_key\": \"/etc/pki/tls/private/ceph_dashboard.key\"}, {\"tripleo_cephadm_dashboard_grafana_api_no_ssl_verify\": true}]}, {\"get_attr\": [\"CephMgrAnsibleVars\", \"value\", \"vars\"]}]}}}]]}]}, \"metadata_settings\": {\"if\": [\"internal_tls_enabled\", [{\"service\": \"ceph_dashboard\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}, \"type\": \"node\"}]]}, \"deploy_steps_tasks\": {\"if\": [\"internal_tls_enabled\", [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"ceph_dashboard\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"ceph_dashboard/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"CephDashboardNetwork\"]}}}}, \"run_after\": \"# Get mgr systemd unit\\nmgr_unit=$(systemctl list-units | awk '/ceph-mgr/ {print $1}')\\n# Restart the mgr systemd unit\\nif [ -n \\\"$mgr_unit\\\" ]; then\\n    systemctl restart \\\"$mgr_unit\\\"\\nfi\\n\", \"key_size\": {\"if\": [\"key_size_override_set\", {\"get_param\": \"CephCertificateKeySize\"}, {\"get_param\": \"CertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}]]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-mon.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Ceph Monitor service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephValidationRetries\": {\"type\": \"number\", \"default\": 40, \"description\": \"Number of retry attempts for Ceph validation\"}, \"CephValidationDelay\": {\"type\": \"number\", \"default\": 30, \"description\": \"Interval (in seconds) in between validation checks\"}, \"CephEnableDashboard\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Parameter used to trigger the dashboard deployment.\"}}, \"conditions\": {\"dashboard_enabled\": {\"equals\": [{\"get_param\": \"CephEnableDashboard\"}, true]}}, \"resources\": {\"CephBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"DefaultPasswords\": {\"get_param\": \"DefaultPasswords\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceph Monitor service.\", \"value\": {\"service_name\": \"ceph_mon\", \"firewall_rules\": {\"110 ceph_mon\": {\"dport\": {\"list_concat\": [[6789], [3300], {\"if\": [\"dashboard_enabled\", [\"9100\"]]}]}}}, \"service_config_settings\": {\"collectd\": {\"tripleo.collectd.plugins.ceph_mon\": [\"ceph\"], \"collectd::plugin::ceph::daemons\": []}}, \"upgrade_tasks\": {\"get_attr\": [\"CephBase\", \"role_data\", \"upgrade_tasks\"]}, \"puppet_config\": {}, \"docker_config\": {}, \"external_deploy_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-osd.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Ceph OSD service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephAnsibleDisksConfig\": {\"type\": \"json\", \"description\": \"Disks config settings.\", \"default\": {\"devices\": [], \"osd_scenario\": \"lvm\", \"osd_objectstore\": \"bluestore\"}}, \"CephClusterName\": {\"type\": \"string\", \"default\": \"ceph\", \"description\": \"The Ceph cluster name.\", \"constraints\": [{\"allowed_pattern\": \"[a-zA-Z0-9]+\", \"description\": \"The Ceph cluster name must be at least 1 character and contain only letters and numbers.\\n\"}]}, \"CephEnableDashboard\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Parameter used to trigger the dashboard deployment.\"}, \"CephHciOsdCount\": {\"type\": \"number\", \"default\": 0, \"tags\": [\"role_specific\"], \"description\": \"The number of expected Ceph OSDs per HCI node. Used by Ansible\\nmodule tripleo_derive_hci_parameters when cephadm/HCI is used. Since\\nCephOsdSpec might only specify a description of devices to be used\\nas OSDs (e.g. all devices), and not a list of devices as found in\\nCephAnsibleDisksConfig, this number is necessary in order to know\\nhow much CPU/RAM to reserve.\\n\"}, \"CephHciOsdType\": {\"type\": \"string\", \"default\": \"hdd\", \"tags\": [\"role_specific\"], \"constraints\": [{\"allowed_values\": [\"hdd\", \"ssd\", \"nvme\"]}], \"description\": \"CephHciOsdType is the type of data_device (not db_device) used for each\\nHCI node's OSD and must be one of hdd, ssd, or nvme. Used by Ansible\\nmodule tripleo_derive_hci_parameters when cephadm/HCI is used. Since\\nCephOsdSpec might only specify a description of devices to be used\\nas OSDs (e.g. all devices), and not a list of devices as found in\\nCephAnsibleDisksConfig, the device path is not hard coded so we cannot\\nlook up that device in Ironic to determine its type. If CephOsdSpec\\nhas data_devices/rotational=1 and db_devices/rotational=0, then set\\nCephHciOsdType to 'hdd', since only the DB/WAL are on SSD. If an OSD\\ndata device is an SSD or NVMe SSD, then set the type accordingly so\\nthat the derive paramters module can allocate the optimal number of\\nCPUs per device.\\n\"}}, \"resources\": {\"CephBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-base.yaml\", \"properties\": {\"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"DefaultPasswords\": {\"get_param\": \"DefaultPasswords\"}, \"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceph OSD service.\", \"value\": {\"service_name\": \"ceph_osd\", \"firewall_rules\": {\"111 ceph_osd\": {\"dport\": {\"list_concat\": [[\"6800-7300\"], {\"if\": [{\"get_param\": \"CephEnableDashboard\"}, [\"9100\"]]}]}}}, \"service_config_settings\": {\"collectd\": {\"tripleo.collectd.plugins.ceph_osd\": [\"ceph\"], \"collectd::plugin::ceph::daemons\": []}}, \"upgrade_tasks\": {\"list_concat\": [{\"get_attr\": [\"CephBase\", \"role_data\", \"upgrade_tasks\"]}, [{\"name\": \"Set noout flag\", \"shell\": \"cephadm shell -c /etc/ceph/{{ tripleo_cephadm_cluster }}.conf -k /etc/ceph/{{ tripleo_cephadm_cluster }}.client.admin.keyring -- ceph osd set {{ item }}\", \"become\": true, \"with_items\": [\"noout\", \"norecover\", \"nobackfill\", \"norebalance\", \"nodeep-scrub\"], \"delegate_to\": \"{{ groups['ceph_mon'][0] }}\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_prepare\"], \"vars\": {\"tripleo_cephadm_cluster\": {\"get_param\": \"CephClusterName\"}}, \"when\": [\"step|int == 1\", \"upgrade_leapp_enabled\"]}], [{\"name\": \"Unset noout flag\", \"shell\": \"cephadm shell -c /etc/ceph/{{ tripleo_cephadm_cluster }}.conf -k /etc/ceph/{{ tripleo_cephadm_cluster }}.client.admin.keyring -- ceph osd unset {{ item }}\", \"with_items\": [\"noout\", \"norecover\", \"nobackfill\", \"norebalance\", \"nodeep-scrub\"], \"delegate_to\": \"{{ groups['ceph_mon'][0] }}\", \"tags\": [\"never\", \"system_upgrade\", \"system_upgrade_prepare\"], \"vars\": {\"tripleo_cephadm_cluster\": {\"get_param\": \"CephClusterName\"}}, \"when\": [\"step|int == 5\"]}]]}, \"puppet_config\": {}, \"docker_config\": {}, \"external_deploy_tasks\": {\"list_concat\": [{\"get_attr\": [\"CephBase\", \"role_data\", \"external_deploy_tasks\"]}, [{\"name\": \"ceph_osd_external_deploy_init\", \"when\": \"step|int == 1\", \"block\": [{\"name\": \"Build disk list for cephadm\", \"set_fact\": {\"cephadm_disk_list\": {\"get_param\": \"CephAnsibleDisksConfig\"}}}]}]]}}}}}", "file:///root/tripleo-heat-installer-templates/deployment/cephadm/ceph-mds.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Ceph Metadata service.\\n\", \"parameters\": {\"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"DefaultPasswords\": {\"default\": {}, \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"CephEnableDashboard\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Parameter used to trigger the dashboard deployment.\"}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Ceph Metadata service.\", \"value\": {\"service_name\": \"ceph_mds\", \"firewall_rules\": {\"112 ceph_mds\": {\"dport\": {\"list_concat\": [[\"6800-7300\"], {\"if\": [{\"get_param\": \"CephEnableDashboard\"}, [\"9100\"]]}]}}}, \"puppet_config\": {}, \"docker_config\": {}, \"external_deploy_tasks\": [], \"external_update_tasks\": [], \"external_upgrade_tasks\": []}}}}", "file:///usr/share/openstack-tripleo-heat-templates/network/ports/deployed_vip_ctlplane.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Deployed VIP port on the Control Plane network.\\n\", \"parameters\": {\"name\": {\"default\": \"\", \"type\": \"string\"}, \"dns_name\": {\"default\": \"\", \"type\": \"string\"}, \"network\": {\"default\": \"\", \"type\": \"string\"}, \"fixed_ips\": {\"default\": \"\", \"type\": \"comma_delimited_list\"}, \"replacement_policy\": {\"default\": \"\", \"type\": \"string\"}, \"tags\": {\"default\": [], \"type\": \"comma_delimited_list\"}, \"ControlPlaneVipData\": {\"description\": \"Control Plane Virtual IP data\\n\", \"default\": {}, \"type\": \"json\"}}, \"outputs\": {\"name\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"name\"]}}, \"fixed_ips\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"fixed_ips\"]}}, \"network\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"network\"]}}, \"subnets\": {\"value\": {\"get_param\": [\"ControlPlaneVipData\", \"subnets\"]}}}}", "file:///usr/share/openstack-tripleo-heat-templates/network/deployed_networks.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"Create networks to split out Overcloud traffic\", \"parameters\": {\"DeployedNetworkEnvironment\": {\"type\": \"json\", \"description\": \"Deployed network environment\"}, \"CtlplaneNetworkCidrs\": {\"type\": \"json\", \"description\": \"Cidrs for the ctlplane network.\"}, \"CtlplaneNetworkAttributes\": {\"type\": \"json\", \"default\": {}, \"description\": \"A map containing attributes of the undercloud ctlplane network and subnets. NOTE: The value for this parameter is automatically populated in the plan environment by tripleoclient.\\n\"}}, \"resources\": {\"NetworkExtraConfig\": {\"type\": \"OS::TripleO::Network::ExtraConfig\"}, \"NetworkAttributesMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"map_merge\": [{\"ctlplane\": {\"get_param\": \"CtlplaneNetworkAttributes\"}}, {\"get_param\": [\"DeployedNetworkEnvironment\", \"net_attributes_map\"]}]}}}, \"NetworkCidrMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"map_merge\": [{\"ctlplane\": {\"get_param\": \"CtlplaneNetworkCidrs\"}}, {\"get_param\": [\"DeployedNetworkEnvironment\", \"net_cidr_map\"]}]}}}, \"NetworkIpVersionMap\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"value\": {\"map_merge\": [{\"ctlplane\": {\"yaql\": {\"expression\": \"$.data.items().first().last().ip_version\", \"data\": {\"get_param\": [\"CtlplaneNetworkAttributes\", \"subnets\"]}}}}, {\"get_param\": [\"DeployedNetworkEnvironment\", \"net_ip_version_map\"]}]}}}}, \"outputs\": {\"net_cidr_map\": {\"value\": {\"get_attr\": [\"NetworkCidrMap\", \"value\"]}}, \"net_ip_version_map\": {\"value\": {\"get_attr\": [\"NetworkIpVersionMap\", \"value\"]}}, \"net_attributes_map\": {\"value\": {\"get_attr\": [\"NetworkAttributesMap\", \"value\"]}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-sriov-agent-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack Neutron SR-IOV service\\n\", \"parameters\": {\"ContainerNeutronSriovImage\": {\"description\": \"The container image to use for the Neutron SR-IOV agent\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"DockerSRIOVUlimit\": {\"default\": [\"nofile=16384\"], \"description\": \"ulimit for SR-IOV Container\", \"type\": \"comma_delimited_list\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"NeutronPhysicalDevMappings\": {\"description\": \"List of <physical_network>:<physical device> All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent. Example \\\"tenant0:ens2f0,tenant1:ens2f1\\\"\\n\", \"type\": \"comma_delimited_list\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NeutronExcludeDevices\": {\"description\": \"List of <network_device>:<excluded_devices> mapping network_device to the agent's node-specific list of virtual functions that should not be used for virtual networking. excluded_devices is a semicolon separated list of virtual functions to exclude from network_device. The network_device in the mapping should appear in the physical_device_mappings list.\\n\", \"type\": \"comma_delimited_list\", \"default\": \"\", \"tags\": [\"role_specific\"]}, \"NeutronSriovAgentExtensions\": {\"default\": \"\", \"description\": \"Comma-separated list of extensions enabled for the Neutron SR-IOV agents.\\n\", \"type\": \"comma_delimited_list\", \"tags\": [\"role_specific\"]}, \"DerivePciWhitelistEnabled\": {\"default\": true, \"description\": \"Whether to enable or not the pci passthrough whitelist automation.\", \"type\": \"boolean\", \"tags\": [\"role_specific\"]}, \"NeutronSriovResourceProviderBandwidths\": {\"description\": \"Comma-separated list of <network_device>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given device in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The device must appear in physical_device_mappings as the value.\\n\", \"type\": \"comma_delimited_list\", \"default\": \"\", \"tags\": [\"role_specific\"]}}, \"conditions\": {\"derive_pci_whitelist_enabled\": {\"or\": [{\"and\": [{\"equals\": [{\"get_param\": \"DerivePciWhitelistEnabled\"}, true]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"DerivePciWhitelistEnabled\"]}, \"\"]}]}, {\"equals\": [{\"get_param\": [\"RoleParameters\", \"DerivePciWhitelistEnabled\"]}, true]}]}}, \"resources\": {\"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"neutron::agents::ml2::sriov::physical_device_mappings\": \"NeutronPhysicalDevMappings\", \"neutron::agents::ml2::sriov::exclude_devices\": \"NeutronExcludeDevices\", \"neutron::agents::ml2::sriov::extensions\": \"NeutronSriovAgentExtensions\", \"neutron::agents::ml2::sriov::resource_provider_bandwidths\": \"NeutronSriovResourceProviderBandwidths\", \"ContainerNeutronSriovImage\": \"ContainerNeutronSriovImage\", \"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"NeutronPhysicalDevMappings\": {\"get_param\": \"NeutronPhysicalDevMappings\"}, \"NeutronExcludeDevices\": {\"get_param\": \"NeutronExcludeDevices\"}, \"NeutronSriovAgentExtensions\": {\"get_param\": \"NeutronSriovAgentExtensions\"}, \"NeutronSriovResourceProviderBandwidths\": {\"get_param\": \"NeutronSriovResourceProviderBandwidths\"}, \"ContainerNeutronSriovImage\": {\"get_param\": \"ContainerNeutronSriovImage\"}, \"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}, \"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"NeutronBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NeutronLogging\": {\"type\": \"OS::TripleO::Services::Logging::NeutronCommon\", \"properties\": {\"NeutronServiceName\": \"sriov-nic-agent\"}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for Neutron sriov service\", \"value\": {\"service_name\": \"neutron_sriov_agent\", \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"RoleParametersValue\", \"value\"]}, {\"get_attr\": [\"NeutronLogging\", \"config_settings\"]}, {\"neutron::agents::ml2::sriov::resource_provider_default_hypervisor\": \"%{hiera('fqdn_canonical')}\"}]}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": \"neutron_config,neutron_agent_sriov_numvfs,neutron_sriov_agent_config\", \"step_config\": \"include tripleo::profile::base::neutron::sriov\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/neutron_sriov_agent.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/neutron-sriov-nic-agent --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/sriov_agent.ini --config-dir /etc/neutron/conf.d/common\", {\"get_attr\": [\"NeutronLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}], \"permissions\": [{\"path\": \"/var/log/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}]}}, \"docker_config\": {\"step_4\": {\"neutron_sriov_agent\": {\"start_order\": 10, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronSriovImage\"]}, \"net\": \"host\", \"pid\": \"host\", \"privileged\": true, \"restart\": \"always\", \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"ulimit\": {\"get_param\": \"DockerSRIOVUlimit\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NeutronLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/neutron_sriov_agent.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro\", \"/lib/modules:/lib/modules:ro\", \"/run:/run\", \"/sys/class/net:/sys/class/net:rw\"]]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NeutronLogging\", \"host_prep_tasks\"]}, [{\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}, {\"if\": [\"derive_pci_whitelist_enabled\", [{\"name\": \"creating directory\", \"file\": {\"state\": \"directory\", \"path\": \"/var/lib/pci_passthrough_whitelist_scripts\", \"owner\": \"root\", \"group\": \"root\", \"mode\": 488}}, {\"name\": \"derive pci passthrough whitelist\", \"copy\": {\"src\": \"/usr/share/openstack-tripleo-heat-templates/deployment/neutron/derive_pci_passthrough_whitelist.py\", \"dest\": \"/var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py\", \"mode\": 448}}, {\"name\": \"run derive_pci_passthrough_whitelist.py\", \"command\": \"/var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py\"}], []]}]]}, \"metadata_settings\": {\"get_attr\": [\"NeutronBase\", \"role_data\", \"metadata_settings\"]}, \"upgrade_tasks\": []}}}}", "file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-dhcp-container-puppet.yaml": "{\"heat_template_version\": \"wallaby\", \"description\": \"OpenStack containerized Neutron DHCP service\\n\", \"parameters\": {\"ContainerNeutronDHCPImage\": {\"description\": \"image\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"ContainerNeutronConfigImage\": {\"description\": \"The container image to use for the neutron config_volume\", \"type\": \"string\", \"tags\": [\"role_specific\"]}, \"DockerNeutronDHCPAgentUlimit\": {\"default\": [\"nofile=16384\"], \"description\": \"ulimit for Neutron DHCP Agent Container\", \"type\": \"comma_delimited_list\"}, \"DockerAdditionalSockets\": {\"default\": [\"/var/lib/openstack/docker.sock\"], \"description\": \"Additional domain sockets for the docker daemon to bind to (useful for mounting into containers that launch other containers)\", \"type\": \"comma_delimited_list\"}, \"NeutronEnableDnsmasqDockerWrapper\": {\"description\": \"Generate a dnsmasq wrapper script so that neutron launches dnsmasq in a separate container.\", \"type\": \"boolean\", \"default\": true}, \"NeutronEnableHaproxyDockerWrapper\": {\"description\": \"Generate a wrapper script so neutron launches haproxy in a separate container.\", \"type\": \"boolean\", \"default\": true}, \"Debug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Set to True to enable debugging on all services.\"}, \"NeutronWrapperDebug\": {\"type\": \"boolean\", \"default\": false, \"description\": \"Controls debugging for the wrapper scripts.\"}, \"ContainerCli\": {\"type\": \"string\", \"default\": \"podman\", \"description\": \"CLI tool used to manage containers.\", \"constraints\": [{\"allowed_values\": [\"docker\", \"podman\"]}]}, \"NeutronDhcpAgentLoggingSource\": {\"type\": \"json\", \"default\": {\"tag\": \"openstack.neutron.agent.dhcp\", \"file\": \"/var/log/containers/neutron/dhcp-agent.log\"}}, \"EndpointMap\": {\"default\": {}, \"description\": \"Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry.\", \"type\": \"json\"}, \"ServiceData\": {\"default\": {}, \"description\": \"Dictionary packing service data\", \"type\": \"json\"}, \"ServiceNetMap\": {\"default\": {}, \"description\": \"Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults.\", \"type\": \"json\"}, \"RoleName\": {\"default\": \"\", \"description\": \"Role name on which the service is applied\", \"type\": \"string\"}, \"RoleParameters\": {\"default\": {}, \"description\": \"Parameters specific to the role\", \"type\": \"json\"}, \"EnableInternalTLS\": {\"type\": \"boolean\", \"default\": false}, \"InternalTLSCAFile\": {\"default\": \"/etc/ipa/ca.crt\", \"type\": \"string\", \"description\": \"Specifies the default CA cert to use if TLS is used for services in the internal network.\"}, \"NeutronEnableMetadataNetwork\": {\"default\": false, \"description\": \"If True, DHCP provide metadata network. Requires either IsolatedMetadata or ForceMetadata parameters to also be True.\", \"type\": \"boolean\"}, \"NeutronEnableIsolatedMetadata\": {\"default\": false, \"description\": \"If True, DHCP provide metadata route to VM.\", \"type\": \"boolean\"}, \"NeutronEnableForceMetadata\": {\"default\": false, \"description\": \"If True, DHCP always provides metadata route to VM.\", \"type\": \"boolean\"}, \"NeutronEnableInternalDNS\": {\"default\": false, \"description\": \"If True, enable the internal Neutron DNS server that provides name\\nresolution between VMs.  This parameter has no effect if\\nNeutronDhcpAgentDnsmasqDnsServers is set.\\n\", \"type\": \"boolean\"}, \"MonitoringSubscriptionNeutronDhcp\": {\"default\": \"overcloud-neutron-dhcp\", \"type\": \"string\"}, \"NeutronDhcpAgentDebug\": {\"default\": false, \"description\": \"Set to True to enable debugging for Neutron DHCP agent.\", \"type\": \"boolean\"}, \"NeutronDhcpAgentDnsmasqDnsServers\": {\"default\": [], \"description\": \"List of servers to use as dnsmasq forwarders\", \"type\": \"comma_delimited_list\"}, \"NeutronInterfaceDriver\": {\"default\": \"neutron.agent.linux.interface.OVSInterfaceDriver\", \"description\": \"Neutron DHCP Agent interface driver\", \"type\": \"string\"}, \"NeutronDhcpOvsIntegrationBridge\": {\"default\": \"\", \"type\": \"string\", \"description\": \"Name of Open vSwitch bridge to use\"}, \"NeutronDhcpServerBroadcastReply\": {\"default\": false, \"description\": \"Neutron DHCP agent to use broadcast in DHCP replies\", \"type\": \"boolean\"}, \"NeutronMechanismDrivers\": {\"default\": \"ovn\", \"description\": \"The mechanism drivers for the Neutron tenant network.\\n\", \"type\": \"comma_delimited_list\"}, \"NeutronDhcpAgentAvailabilityZone\": {\"description\": \"Availability zone for Neutron DHCP agent. If not set, no AZs will be configured for Neutron network services.\", \"default\": \"\", \"type\": \"string\"}, \"NeutronDhcpAgentDnsmasqEnableAddr6List\": {\"default\": true, \"description\": \"Enable dhcp-host entry with list of addresses when port has multiple\\nIPv6 addresses in the same subnet.\\n\", \"type\": \"boolean\"}, \"CertificateKeySize\": {\"type\": \"string\", \"default\": \"2048\", \"description\": \"Specifies the private key size used when creating the certificate.\"}, \"NeutronDhcpCertificateKeySize\": {\"type\": \"string\", \"default\": \"\", \"description\": \"Override the private key size used when creating the certificate for this service\"}}, \"conditions\": {\"internal_tls_enabled\": {\"equals\": [{\"get_param\": \"EnableInternalTLS\"}, true]}, \"dnsmasq_wrapper_enabled\": {\"equals\": [{\"get_param\": \"NeutronEnableDnsmasqDockerWrapper\"}, true]}, \"haproxy_wrapper_enabled\": {\"equals\": [{\"get_param\": \"NeutronEnableHaproxyDockerWrapper\"}, true]}, \"docker_enabled\": {\"equals\": [{\"get_param\": \"ContainerCli\"}, \"docker\"]}, \"dhcp_ovs_intergation_bridge_unset\": {\"equals\": [{\"get_param\": \"NeutronDhcpOvsIntegrationBridge\"}, \"\"]}, \"az_unset\": {\"equals\": [{\"get_param\": \"NeutronDhcpAgentAvailabilityZone\"}, \"\"]}, \"key_size_override_unset\": {\"equals\": [{\"get_param\": \"NeutronDhcpCertificateKeySize\"}, \"\"]}}, \"resources\": {\"ContainersCommon\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/containers-common.yaml\"}, \"NeutronBase\": {\"type\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/neutron-base.yaml\", \"properties\": {\"EndpointMap\": {\"get_param\": \"EndpointMap\"}, \"ServiceData\": {\"get_param\": \"ServiceData\"}, \"ServiceNetMap\": {\"get_param\": \"ServiceNetMap\"}, \"RoleName\": {\"get_param\": \"RoleName\"}, \"RoleParameters\": {\"get_param\": \"RoleParameters\"}}}, \"NeutronLogging\": {\"type\": \"OS::TripleO::Services::Logging::NeutronCommon\", \"properties\": {\"NeutronServiceName\": \"dhcp-agent\"}}, \"RoleParametersValue\": {\"type\": \"OS::Heat::Value\", \"properties\": {\"type\": \"json\", \"value\": {\"map_replace\": [{\"map_replace\": [{\"ContainerNeutronDHCPImage\": \"ContainerNeutronDHCPImage\", \"ContainerNeutronConfigImage\": \"ContainerNeutronConfigImage\"}, {\"values\": {\"get_param\": [\"RoleParameters\"]}}]}, {\"values\": {\"ContainerNeutronDHCPImage\": {\"get_param\": \"ContainerNeutronDHCPImage\"}, \"ContainerNeutronConfigImage\": {\"get_param\": \"ContainerNeutronConfigImage\"}}}]}}}}, \"outputs\": {\"role_data\": {\"description\": \"Role data for the Neutron DHCP role.\", \"value\": {\"service_name\": \"neutron_dhcp\", \"firewall_rules\": {\"115 neutron dhcp input\": {\"ipversion\": \"ipv4\", \"proto\": \"udp\", \"dport\": 67}, \"116 neutron dhcp output\": {\"ipversion\": \"ipv4\", \"proto\": \"udp\", \"chain\": \"OUTPUT\", \"dport\": 68}, \"115 neutron dhcpv6 input\": {\"ipversion\": \"ipv6\", \"proto\": \"udp\", \"dport\": 547}, \"116 neutron dhcpv6 output\": {\"ipversion\": \"ipv6\", \"proto\": \"udp\", \"chain\": \"OUTPUT\", \"dport\": 546}, \"116 neutron dhcpv6 relay output\": {\"ipversion\": \"ipv6\", \"proto\": \"udp\", \"chain\": \"OUTPUT\", \"dport\": 547}}, \"monitoring_subscription\": {\"get_param\": \"MonitoringSubscriptionNeutronDhcp\"}, \"config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"config_settings\"]}, {\"get_attr\": [\"NeutronLogging\", \"config_settings\"]}, {\"tripleo::profile::base::neutron::dhcp_agent_wrappers::enable_dnsmasq_wrapper\": {\"get_param\": \"NeutronEnableDnsmasqDockerWrapper\"}, \"tripleo::profile::base::neutron::dhcp_agent_wrappers::dnsmasq_process_wrapper\": \"/var/lib/neutron/dnsmasq_wrapper\", \"tripleo::profile::base::neutron::dhcp_agent_wrappers::dnsmasq_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronDHCPImage\"]}, \"tripleo::profile::base::neutron::dhcp_agent_wrappers::enable_haproxy_wrapper\": {\"get_param\": \"NeutronEnableHaproxyDockerWrapper\"}, \"tripleo::profile::base::neutron::dhcp_agent_wrappers::haproxy_process_wrapper\": \"/var/lib/neutron/dhcp_haproxy_wrapper\", \"tripleo::profile::base::neutron::dhcp_agent_wrappers::haproxy_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronDHCPImage\"]}, \"tripleo::profile::base::neutron::dhcp_agent_wrappers::debug\": {\"if\": [{\"get_param\": \"NeutronWrapperDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"tripleo::profile::base::neutron::container_cli\": {\"get_param\": \"ContainerCli\"}, \"neutron::agents::dhcp::enable_isolated_metadata\": {\"get_param\": \"NeutronEnableIsolatedMetadata\"}, \"neutron::agents::dhcp::enable_force_metadata\": {\"get_param\": \"NeutronEnableForceMetadata\"}, \"neutron::agents::dhcp::enable_metadata_network\": {\"get_param\": \"NeutronEnableMetadataNetwork\"}, \"neutron::agents::dhcp::dnsmasq_local_resolv\": {\"get_param\": \"NeutronEnableInternalDNS\"}, \"neutron::agents::dhcp::dnsmasq_dns_servers\": {\"get_param\": \"NeutronDhcpAgentDnsmasqDnsServers\"}, \"neutron::agents::dhcp::interface_driver\": {\"get_param\": \"NeutronInterfaceDriver\"}, \"neutron::agents::dhcp::dhcp_broadcast_reply\": {\"get_param\": \"NeutronDhcpServerBroadcastReply\"}, \"neutron::agents::dhcp::dnsmasq_enable_addr6_list\": {\"get_param\": \"NeutronDhcpAgentDnsmasqEnableAddr6List\"}, \"neutron::agents::dhcp::debug\": {\"if\": [{\"get_param\": \"NeutronDhcpAgentDebug\"}, true, {\"get_param\": \"Debug\"}]}}, {\"if\": [\"internal_tls_enabled\", {\"neutron::agents::dhcp::ovsdb_agent_ssl_key_file\": \"/etc/pki/tls/private/neutron.key\", \"neutron::agents::dhcp::ovsdb_agent_ssl_cert_file\": \"/etc/pki/tls/certs/neutron.crt\", \"neutron::agents::dhcp::ovsdb_agent_ssl_ca_file\": {\"get_param\": \"InternalTLSCAFile\"}}, {}]}, {\"if\": [\"dhcp_ovs_intergation_bridge_unset\", {}, {\"neutron::agents::dhcp::ovs_integration_bridge\": {\"get_param\": \"NeutronDhcpOvsIntegrationBridge\"}}]}, {\"if\": [\"az_unset\", {}, {\"neutron::agents::dhcp::availability_zone\": {\"get_param\": \"NeutronDhcpAgentAvailabilityZone\"}}]}]}, \"service_config_settings\": {\"map_merge\": [{\"get_attr\": [\"NeutronBase\", \"role_data\", \"service_config_settings\"]}, {\"rsyslog\": {\"tripleo_logging_sources_neutron_dhcp\": [{\"get_param\": \"NeutronDhcpAgentLoggingSource\"}]}}]}, \"puppet_config\": {\"config_volume\": \"neutron\", \"puppet_tags\": \"neutron_config,neutron_dhcp_agent_config\", \"step_config\": \"include tripleo::profile::base::neutron::dhcp\\n\", \"config_image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronConfigImage\"]}}, \"kolla_config\": {\"/var/lib/kolla/config_files/neutron_dhcp.json\": {\"command\": {\"list_join\": [\" \", [\"/usr/bin/neutron-dhcp-agent --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/dhcp_agent.ini --config-dir /etc/neutron/conf.d/common --config-dir /etc/neutron/conf.d/neutron-dhcp-agent\", {\"get_attr\": [\"NeutronLogging\", \"cmd_extra_args\"]}]]}, \"config_files\": [{\"source\": \"/var/lib/kolla/config_files/src/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true}, {\"source\": \"/var/lib/kolla/config_files/src-tls/*\", \"dest\": \"/\", \"merge\": true, \"preserve_properties\": true, \"optional\": true}], \"permissions\": [{\"path\": \"/var/log/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}, {\"path\": \"/var/lib/neutron\", \"owner\": \"neutron:neutron\", \"recurse\": true}, {\"path\": \"/etc/pki/tls/certs/neutron.crt\", \"owner\": \"neutron:neutron\"}, {\"path\": \"/etc/pki/tls/private/neutron.key\", \"owner\": \"neutron:neutron\"}]}}, \"container_config_scripts\": {\"get_attr\": [\"ContainersCommon\", \"container_config_scripts\"]}, \"docker_config\": {\"step_2\": {\"create_dnsmasq_wrapper\": {\"start_order\": 1, \"detach\": false, \"net\": \"host\", \"pid\": \"host\", \"user\": \"root\", \"command\": {\"list_concat\": [[\"/container_puppet_apply.sh\", \"4\", \"file\", \"include ::tripleo::profile::base::neutron::dhcp_agent_wrappers\"]]}, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronDHCPImage\"]}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"container_puppet_apply_volumes\"]}, [\"/run/openvswitch:/run/openvswitch:shared,z\", \"/var/lib/neutron:/var/lib/neutron:shared,z\"]]}}}, \"step_4\": {\"neutron_dhcp\": {\"start_order\": 10, \"image\": {\"get_attr\": [\"RoleParametersValue\", \"value\", \"ContainerNeutronDHCPImage\"]}, \"net\": \"host\", \"pid\": \"host\", \"cgroupns\": \"host\", \"privileged\": true, \"restart\": \"always\", \"security_opt\": [\"label=disable\"], \"depends_on\": [\"openvswitch.service\"], \"healthcheck\": {\"get_attr\": [\"ContainersCommon\", \"healthcheck_rpc_port\"]}, \"ulimit\": {\"get_param\": \"DockerNeutronDHCPAgentUlimit\"}, \"volumes\": {\"list_concat\": [{\"get_attr\": [\"ContainersCommon\", \"volumes\"]}, {\"get_attr\": [\"NeutronLogging\", \"volumes\"]}, [\"/var/lib/kolla/config_files/neutron_dhcp.json:/var/lib/kolla/config_files/config.json:ro\", \"/var/lib/config-data/puppet-generated/neutron:/var/lib/kolla/config_files/src:ro\", \"/lib/modules:/lib/modules:ro\", \"/run/openvswitch:/run/openvswitch:shared,z\", \"/var/lib/neutron:/var/lib/neutron:shared,z\", \"/run/netns:/run/netns:shared\", \"/var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z\"], {\"if\": [\"docker_enabled\", [\"/var/lib/openstack:/var/lib/openstack\"], null]}, {\"if\": [\"dnsmasq_wrapper_enabled\", [\"/var/lib/neutron/dnsmasq_wrapper:/usr/local/bin/dnsmasq:ro\"], null]}, {\"if\": [\"haproxy_wrapper_enabled\", [\"/var/lib/neutron/dhcp_haproxy_wrapper:/usr/local/bin/haproxy:ro\"], null]}, {\"if\": [\"internal_tls_enabled\", [\"/etc/pki/tls/certs/neutron.crt:/var/lib/kolla/config_files/src-tls/etc/pki/tls/certs/neutron.crt:ro\", \"/etc/pki/tls/private/neutron.key:/var/lib/kolla/config_files/src-tls/etc/pki/tls/private/neutron.key:ro\"], null]}]}, \"environment\": {\"KOLLA_CONFIG_STRATEGY\": \"COPY_ALWAYS\"}}}}, \"metadata_settings\": {\"if\": [\"internal_tls_enabled\", [{\"service\": \"neutron\", \"network\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}, \"type\": \"node\"}], null]}, \"deploy_steps_tasks\": [{\"name\": \"Certificate generation\", \"when\": [\"step|int == 1\", \"enable_internal_tls\"], \"block\": [{\"include_role\": {\"name\": \"linux-system-roles.certificate\"}, \"vars\": {\"certificate_requests\": [{\"name\": \"neutron\", \"dns\": {\"str_replace\": {\"template\": \"{{fqdn_$NETWORK}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}, \"principal\": {\"str_replace\": {\"template\": \"neutron/{{fqdn_$NETWORK}}@{{idm_realm}}\", \"params\": {\"$NETWORK\": {\"get_param\": [\"ServiceNetMap\", \"NeutronApiNetwork\"]}}}}, \"run_after\": \"container_name=$({{container_cli}} ps --format=\\\\{\\\\{.Names\\\\}\\\\} | grep neutron_dhcp)\\n# The certificate is also installed on the computes, but neutron_dhcp is only\\n# present on the controllers, so we exit if the container could not be found.\\n[[ -z $container_name ]] && exit 0\\n\\nservice_crt=\\\"/etc/pki/tls/certs/neutron.crt\\\"\\nservice_key=\\\"/etc/pki/tls/private/neutron.key\\\"\\n# Copy the new cert from the mount-point to the real path\\n{{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_crt\\\" \\\"$service_crt\\\"\\n# Copy the new key from the mount-point to the real path\\n{{container_cli}} exec -u root \\\"$container_name\\\" cp \\\"/var/lib/kolla/config_files/src-tls$service_key \\\"$service_key\\\"\\n# No need to trigger a reload for neutron dhcpd since the cert is not cached\\n\", \"key_size\": {\"if\": [\"key_size_override_unset\", {\"get_param\": \"CertificateKeySize\"}, {\"get_param\": \"NeutronDhcpCertificateKeySize\"}]}, \"ca\": \"ipa\"}]}}]}], \"host_prep_tasks\": {\"list_concat\": [{\"get_attr\": [\"NeutronLogging\", \"host_prep_tasks\"]}, [{\"name\": \"create /run/netns with temp namespace\", \"command\": \"ip netns add ns_temp\", \"register\": \"ipnetns_add_result\", \"failed_when\": false}, {\"name\": \"remove temp namespace\", \"command\": \"ip netns delete ns_temp\", \"failed_when\": false, \"when\": [\"ipnetns_add_result.rc is defined\", \"ipnetns_add_result.rc == 0\"]}, {\"name\": \"create /var/lib/neutron\", \"file\": {\"path\": \"/var/lib/neutron\", \"state\": \"directory\", \"setype\": \"container_file_t\"}}, {\"name\": \"enable virt_sandbox_use_netlink for healthcheck\", \"seboolean\": {\"name\": \"virt_sandbox_use_netlink\", \"persistent\": true, \"state\": true}, \"when\": [\"ansible_facts.selinux is defined\", \"ansible_facts.selinux.status == \\\"enabled\\\"\"]}, {\"name\": \"set conditions\", \"set_fact\": {\"dnsmasq_wrapper_enabled\": {\"get_param\": \"NeutronEnableDnsmasqDockerWrapper\"}, \"haproxy_wrapper_enabled\": {\"get_param\": \"NeutronEnableHaproxyDockerWrapper\"}, \"debug_enabled\": {\"if\": [{\"get_param\": \"NeutronWrapperDebug\"}, true, {\"get_param\": \"Debug\"}]}, \"docker_additional_sockets\": {\"get_param\": \"DockerAdditionalSockets\"}}}, {\"name\": \"create kill_scripts directory within /var/lib/neutron\", \"file\": {\"state\": \"directory\", \"path\": \"/var/lib/neutron/kill_scripts\"}}, {\"name\": \"create dnsmasq dhcp kill script\", \"when\": \"dnsmasq_wrapper_enabled|bool\", \"copy\": {\"dest\": \"/var/lib/neutron/kill_scripts/dnsmasq-kill\", \"mode\": 493, \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/kill-script\"}}}, {\"name\": \"create haproxy kill script\", \"when\": \"haproxy_wrapper_enabled|bool\", \"copy\": {\"dest\": \"/var/lib/neutron/kill_scripts/haproxy-kill\", \"mode\": 493, \"content\": {\"get_file\": \"file:///root/tripleo-heat-installer-templates/deployment/neutron/kill-script\"}}}]]}, \"upgrade_tasks\": []}}}}"}


