openshift.yaml

heat_template_version: 2014-10-16


description: >
  Deploy Atomic/OpenShift 3 on OpenStack.


parameters:

  # Access to the VMs
  ssh_user:
    type: string
    description: >
      The SSH user available on all nodes.
    default: 'cloud-user'

  ssh_key_name:
    type: string
    description: Name of the SSH keypair registered with Nova
    constraints:
    - custom_constraint: nova.keypair

  # VM characteristics
  server_image:
    type: string
    description: Name or ID of the host image registered with Glance
    constraints:
    - custom_constraint: glance.image

  lb_image:
    type: string
    description: Name or ID of the loadbalancer host image registered with Glance
    constraints:
    - custom_constraint: glance.image

  flavor:
    type: string
    description: The Nova flavor to use for the OpenShift nodes
    default: m1.medium
    constraints:
    - custom_constraint: nova.flavor


  # Networks to connect to or create
  external_network:
    type: string
    description: >
      The external network that provides floating IP addresses for the nodes
    constraints:
    - custom_constraint: neutron.network

  internal_subnet:
    type: string
    description: >
      The subnet used for openshift node-node and node-master communication
    default: 192.168.0.0/24

  dns_nameserver:
    type: comma_delimited_list
    description: address of a dns nameserver reachable in your environment
    default: 8.8.8.8


  master_count:
    type: number
    description: >
      Number of non-master nodes to create.
    default: 1

  master_server_group_policies:
    type: comma_delimited_list
    description: >
      List of policies applied on master nodes ServerGroup.
    default: ['anti-affinity']


  node_count:
    type: number
    description: >
      Number of non-master nodes to create.
    default: 1

  # VM Host naming: root domain and host names
  domain_name:
    type: string
    description: >
      The domain name that is going to be used as the base for all hostnames.

  dns_hostname:
    type: string
    description: >
      The hostname that is going to be set for the DNS server.
    default: "ns"

  lb_hostname:
    type: string
    description: >
      The hostname that is going to be set for the loadbalancer server.
    default: ''

  infra_hostname:
    type: string
    description: >
      The hostname that is going to be set for the dedicated infra node.
    default: 'infra'

  master_hostname_prefix:
    type: string
    description: >
      The hostname that is going to be set for the master.
    default: "openshift-master"

  node_hostname_prefix:
    type: string
    description: >
      The hostname prefix that is going to be set for the nodes.
    default: "openshift-node"

  # Persistant(?) Storage for Docker
  master_docker_volume_size_gb:
    type: number
    description: >
      size of a cinder volume in GB to allocate to docker for container/image
      storage
    default: 25

  node_docker_volume_size_gb:
    type: number
    description: >
      size of a cinder volume in GB to allocate to docker for container/image
      storage
    default: 25


  # Node scaling parameters
  autoscaling:
    type: boolean
    description: >
      Automatically scale up/down openshift nodes.
    default: false

  openshift_nodes_min:
    type: number
    description: >
      Minimum number of openshift nodes if autoscaling is enabled.
    default: 1

  openshift_nodes_max:
    type: number
    description: >
      Maximum number of openshift nodes if autoscaling is enabled.
    default: 5

  # Internal and Auxiliary Services
  openshift_sdn:
    type: string
    description: Software to get an overlay network up and running for Openshift
    constraints:
      - allowed_values:
        - openshift-sdn
        - flannel
        - none
    default: openshift-sdn

  deploy_registry:
    type: boolean
    description: >
      Specify if a Docker registry should be deployed.
    default: false

  deploy_router:
    type: boolean
    description: >
      Specify if a router should be deployed.
    default: false

  # OpenShift configuration: ansible controls
  skip_ansible:
    type: boolean
    description: >
      Do not install Openshift using Ansible
    default: false

  openshift_ansible_git_url:
    type: string
    description: >
      The URL to the git repository with the openshift-ansible templates to
      clone.
    default: ""

  openshift_ansible_git_rev:
    type: string
    description: >
      The git revision of the openshift-ansible repository to check out to.
    default: ""

  deployment_type:
    type: string
    description: >
      The type of Openshift deployment.  origin and openshift-enterprise
      are valid.
    default: "origin"
    constraints:
      - allowed_values:
        - origin
        - openshift-enterprise

  # Red Hat subscription parameters
  rhn_username:
    type: string
    description: >
      The username for registering the hosts with RHN. If empty, they will not
      be registered.
    default: ''

  rhn_password:
    type: string
    description: >
      The password for registering the hosts with RHN. If empty, they will not
      be registered.
    hidden: true
    default: ''

  rhn_pool:
    type: string
    description: >
      The pool to attach. Will use `subscription-manager attach --auto` if left
      blank.
    hidden: true
    default: ''

resources:

  # Network Components
  fixed_network:
    type: OS::Neutron::Net

  fixed_subnet:
    type: OS::Neutron::Subnet
    properties:
      cidr: {get_param: internal_subnet}
      network: {get_resource: fixed_network}
      dns_nameservers: {get_param: dns_nameserver}

  external_router:
    type: OS::Neutron::Router
    properties:
      external_gateway_info:
        network: {get_param: external_network}

  external_router_interface:
    type: OS::Neutron::RouterInterface
    properties:
      router_id: {get_resource: external_router}
      subnet: {get_resource: fixed_subnet}

  # VM Host definitions
  lb_host:
    depends_on: external_router_interface
    type: OS::LoadBalancer
    properties:
      image: {get_param: lb_image}
      flavor: {get_param: flavor}
      key_name: {get_param: ssh_key_name}
      ssh_user: {get_param: ssh_user}
      rhn_username: {get_param: rhn_username}
      rhn_password: {get_param: rhn_password}
      rhn_pool: {get_param: rhn_pool}
      hostname: {get_param: lb_hostname}
      domain_name: {get_param: domain_name}
      external_network: {get_param: external_network}
      fixed_network: {get_resource: fixed_network}
      fixed_subnet: {get_resource: fixed_subnet}
      ansible_public_key: {get_attr: [ansible_keys, public_key]}
      dns_ip: {get_attr: [infra_floating_ip, floating_ip_address]}

  infra_host:
    depends_on: external_router_interface
    type: infra.yaml
    properties:
      image: {get_param: server_image}
      flavor: {get_param: flavor}
      key_name: {get_param: ssh_key_name}
      ssh_user: {get_param: ssh_user}
      rhn_username: {get_param: rhn_username}
      rhn_password: {get_param: rhn_password}
      rhn_pool: {get_param: rhn_pool}
      hostname: {get_param: infra_hostname}
      domain_name: {get_param: domain_name}
      external_network: {get_param: external_network}
      fixed_network: {get_resource: fixed_network}
      fixed_subnet: {get_resource: fixed_subnet}
      ansible_public_key: {get_attr: [ansible_keys, public_key]}
      ansible_private_key: {get_attr: [ansible_keys, private_key]}
      deployment_type: {get_param: deployment_type}
      openshift_sdn: {get_param: openshift_sdn}
      floating_ip: {get_attr: [infra_floating_ip, floating_ip_address]}
      dns_ip: {get_attr: [infra_floating_ip, floating_ip_address]}
      port: {get_resource: infra_port}
      docker_volume_size: {get_param: master_docker_volume_size_gb}
      lb_hostname: {get_param: lb_hostname}
      lb_ip: {get_attr: [lb_host, floating_ip]}
      deploy_registry: {get_param: deploy_registry}
      deploy_router: {get_param: deploy_router}
      skip_ansible: {get_param: skip_ansible}
      openshift_ansible_git_url: {get_param: openshift_ansible_git_url}
      openshift_ansible_git_rev: {get_param: openshift_ansible_git_rev}

  openshift_masters:
    depends_on: external_router_interface
    type: OS::Heat::ResourceGroup
    properties:
      count: {get_param: master_count}
      resource_def:
        type: master.yaml
        properties:
          image: {get_param: server_image}
          flavor: {get_param: flavor}
          key_name: {get_param: ssh_key_name}
          ssh_user: {get_param: ssh_user}
          dns_ip: {get_attr: [infra_floating_ip, floating_ip_address]}
          rhn_username: {get_param: rhn_username}
          rhn_password: {get_param: rhn_password}
          rhn_pool: {get_param: rhn_pool}
          deployment_type: {get_param: deployment_type}
          docker_volume_size: {get_param: master_docker_volume_size_gb}
          hostname_prefix: {get_param: master_hostname_prefix}
          domain_name: {get_param: domain_name}
          ansible_public_key: {get_attr: [ansible_keys, public_key]}
          ansible_private_key: {get_attr: [ansible_keys, private_key]}
          infra_node: {get_attr: [infra_host, resource.host]}
          infra_node_add: {get_attr: [infra_host, resource.node_add]}
          fixed_network: {get_resource: fixed_network}
          fixed_subnet: {get_resource: fixed_subnet}
          external_network: {get_param: external_network}
          lb_hostname: {get_param: lb_hostname}
          openshift_sdn: {get_param: openshift_sdn}
          deploy_registry: {get_param: deploy_registry}
          deploy_router: {get_param: deploy_router}
          master_server_group: {get_resource: master_server_group}
          master_security_group: {get_resource: master_security_group}

  openshift_nodes:
    depends_on: external_router_interface
    type: OS::Heat::AutoScalingGroup
    properties:
      desired_capacity: {get_param: node_count}
      min_size: {get_param: openshift_nodes_min}
      max_size: {get_param: openshift_nodes_max}
      resource:
        type: node.yaml
        properties:
          image: {get_param: server_image}
          flavor: {get_param: flavor}
          key_name: {get_param: ssh_key_name}
          ssh_user: {get_param: ssh_user}
          external_network: {get_param: external_network}
          dns_ip: {get_attr: [infra_floating_ip, floating_ip_address]}
          fixed_network: {get_resource: fixed_network}
          fixed_subnet: {get_resource: fixed_subnet}
          docker_volume_size: {get_param: node_docker_volume_size_gb}
          rhn_username: {get_param: rhn_username}
          rhn_password: {get_param: rhn_password}
          rhn_pool: {get_param: rhn_pool}
          hostname_prefix: {get_param: node_hostname_prefix}
          domain_name: {get_param: domain_name}
          ansible_public_key: {get_attr: [ansible_keys, public_key]}
          #master_node: {get_attr: [openshift_masters, resource.0.host]}
          master_node: {get_attr: [infra_host, resource.host]}
          master_run_ansible: {get_attr: [infra_host, resource.run_ansible]}
          infra_node: {get_attr: [infra_host, resource.host]}
          infra_node_cleanup: {get_attr: [infra_host, resource.node_cleanup]}
          infra_node_add: {get_attr: [infra_host, resource.node_add]}
          metadata: {"metering.stack": {get_param: "OS::stack_id"}}
          all_master_nodes:
            list_join:
              - " "
              - {get_attr: [openshift_masters, hostname]}

  # Scaling and Operational Controls
  scale_up_policy:
    type: OS::Heat::ScalingPolicy
    properties:
      adjustment_type: change_in_capacity
      auto_scaling_group_id: {get_resource: openshift_nodes}
      cooldown: 60
      scaling_adjustment: 1

  scale_down_policy:
    type: OS::Heat::ScalingPolicy
    properties:
      adjustment_type: change_in_capacity
      auto_scaling_group_id: {get_resource: openshift_nodes}
      cooldown: 60
      scaling_adjustment: '-1'

  cpu_alarm_high:
    type: OS::Ceilometer::Alarm
    properties:
      meter_name: cpu_util
      statistic: avg
      period: 60
      evaluation_periods: 1
      threshold: 50
      enabled: {get_param: autoscaling}
      alarm_actions:
        - {get_attr: [scale_up_policy, alarm_url]}
      matching_metadata: {'metadata.user_metadata.stack': {get_param: "OS::stack_id"}}
      comparison_operator: gt

  cpu_alarm_low:
    type: OS::Ceilometer::Alarm
    properties:
      meter_name: cpu_util
      statistic: avg
      period: 600
      evaluation_periods: 1
      threshold: 15
      enabled: {get_param: autoscaling}
      alarm_actions:
        - {get_attr: [scale_down_policy, alarm_url]}
      matching_metadata: {'metadata.user_metadata.stack': {get_param: "OS::stack_id"}}
      comparison_operator: lt

  infra_port:
    type: OS::Neutron::Port
    properties:
      security_groups:
      - {get_resource: infra_security_group}
      network: {get_resource: fixed_network}
      fixed_ips:
      - subnet: {get_resource: fixed_subnet}
      replacement_policy: AUTO

  infra_security_group:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
      - protocol: icmp
      - protocol: tcp
        port_range_min: 22
        port_range_max: 22
      - protocol: tcp
        port_range_min: 53
        port_range_max: 53
      - protocol: udp
        port_range_min: 53
        port_range_max: 53

  infra_floating_ip:
    type: OS::Neutron::FloatingIP
    properties:
      floating_network: {get_param: external_network}
      port_id: {get_resource: infra_port}

  ansible_keys:
    type: OS::Nova::KeyPair
    properties:
      name:
        str_replace:
          template: "ansible_keys_STACK"
          params:
            STACK: {get_param: "OS::stack_id"}
      save_private_key: True

  # OpenShift web and REST API network controls
  master_server_group:
    type: OS::Nova::ServerGroup
    properties:
      name: master_server_group
      policies: {get_param: master_server_group_policies}

  master_security_group:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
      - protocol: icmp
      # Just open everything for now:
      - protocol: tcp
        port_range_min: 0
        port_range_max: 65535
      - protocol: udp
        port_range_min: 0
        port_range_max: 65535

outputs:
  # TODO: return the master's certificate authority here so we can use the CLI
  # outside of the host.
  # It's stored at `/etc/openshift/master/ca.crt`
  #master_ip:
  #  description: IP address of the OpenShift master node
  #  value: {get_attr: [master_floating_ip, floating_ip_address]}
  dns_ip:
    description: IP address of the DNS server OpenShift relies on
    value: {get_attr: [infra_floating_ip, floating_ip_address]}
  lb_console_url:
    description: URL of the OpenShift web console
    value: {get_attr: [lb_host, console_url]}
  lb_api_url:
    description: URL entrypoint to the OpenShift API
    value: {get_attr: [lb_host, api_url]}


  master_console_url:
    description: URL of the OpenShift web console
    value:
      list_join:
        - ","
        - {get_attr: [openshift_masters, console_url]}
  master_api_url:
    description: URL entrypoint to the OpenShift API
    value:
      list_join:
        - ","
        - {get_attr: [openshift_masters, api_url]}
  #master_data:
  #  description: Status of boot setup on the master.
  #  value: {get_attr: [openshift_master, wc_data]}

  host_ips:
    description: IP addresses of the OpenShift nodes
    value: {get_attr: [openshift_nodes, outputs_list, ip_address]}

  scale_up_url:
    description: >
      This URL is the webhook to scale up the autoscaling group.  You
      can invoke the scale-up operation by doing an HTTP POST to this
      URL; no body nor extra headers are needed.
    value: {get_attr: [scale_up_policy, alarm_url]}
  scale_dn_url:
    description: >
      This URL is the webhook to scale down the autoscaling group.
      You can invoke the scale-down operation by doing an HTTP POST to
      this URL; no body nor extra headers are needed.
    value: {get_attr: [scale_down_policy, alarm_url]}

  ca_cert:
    description: Openshift CA certificate.
    value: {"Fn::Select": ["0", {get_attr: [openshift_nodes, outputs_list, ca_cert]}]}
  ca_key:
    description: Openshift CA certificate key.
    value: {"Fn::Select": ["0", {get_attr: [openshift_nodes, outputs_list, ca_key]}]}