loadbalancer_dedicated.yaml

heat_template_version: 2016-10-14

description: >
  A template which provides a creates a loadbalancer using neutron's LBaaS.

parameters:

  # What version of OpenShift Container Platform to install
  # This value is used to select the RPM repo for the OCP release to install
  ocp_version:
    type: string
    description: >
      The version of OpenShift Container Platform to deploy

  key_name:
    description: >
      A pre-submitted SSH key to access the VM hosts
    type: string
    constraints:
    - custom_constraint: nova.keypair

  image:
    description: >
      Select a base image to use for the bastion server
    type: string
    constraints:
    - custom_constraint: glance.image

  flavor:
    description: >
      Define the hardware characteristics for the VMs: CPU, Memory, base disk
    type: string
    constraints:
    - custom_constraint: nova.flavor

  hostname:
    description: >
      The load balancer hostname portion of the FQDN
    type: string
    constraints:
    - allowed_pattern: '[a-z0-9\-\.]*'
      description: Hostname must contain only characters [a-z0-9\-\.].

  domain_name:
    description: >
      All VMs will be placed in this domain
    type: string

  app_subdomain:
    type: string

  rhn_username:
    description: >
      A valid user with entitlements to RHEL and OpenShift software repos
    type: string

  rhn_password:
    description: >
      The password for the RHN user
    type: string
    hidden: true

  # Red Hat satellite subscription parameters
  sat6_hostname:
    type: string
    description: >
      The hostname of the Satellite 6 server which will provide software updates
    default: ''

  sat6_organization:
    type: string
    description: >
      An organization string provided by Sat6 to group subscriptions
    default: ''

  sat6_activationkey:
    type: string
    description: >
      An activation key string provided by Sat6 to enable subscriptions

  rhn_pool:
    description: >
      A subscription pool containing the RHEL and OpenShift software repos
      OPTIONAL
    type: string
    hidden: true

  extra_rhn_pools:
    type: comma_delimited_list
    description: List of rhn pools which will be installed on each node.
    default: ''

  ssh_user:
    description: >
      The user for SSH access to the VM hosts
    type: string

  ansible_public_key:
    description: >
      The SSH public key that Ansible will use to access master and node hosts
      This will be placed on each VM host in /root/.ssh/authorized_keys
    type: string

  fixed_subnet:
    description: >
      The name or ID of the internal IPv4 space
    type: string
    constraints:
    - custom_constraint: neutron.subnet

  members:
    type: comma_delimited_list

  master_hostname:
    type: string

  floatingip_id:
    type: string

  floatingip:
    type: string

  fixed_network:
    description: >
      The name or ID of the internal network
    type: string
    constraints:
    - custom_constraint: neutron.network

  fixed_subnet:
    description: >
      The name or ID of the internal IPv4 space
    type: string
    constraints:
    - custom_constraint: neutron.subnet

  extra_repository_urls:
    type: comma_delimited_list
    description: List of repository URLs which will be installed on each node.
    default: ''

  extra_docker_repository_urls:
    type: comma_delimited_list
    description: List of docker repository URLs which will be installed on each node, if a repo is insecure use '#insecure' suffix.
    default: ''

  stack_name:
    type: string
    default: ''

  # Delay openshift installation until the master is ready to accept
  timeout:
    description: Time to wait until the master setup is ready.
    type: number
    default: 4000

  bastion_node:
    type: string
    description: >
      The name or ID of an bastion instance.
    default: ''

  stack_name:
    description: Top level stack name.
    type: string

  dns_servers:
    type: comma_delimited_list
    description: address of dns nameservers reachable in your environment

  dns_update_key:
    type: string
    hidden: true

  ca_cert:
    type: string
    description: Certificate Authority Certificate to be added to trust chain

resources:
  floating_ip_assoc:
    type: OS::Neutron::FloatingIPAssociation
    properties:
      port_id: {get_resource: port}
      floatingip_id: {get_param: floatingip_id}

  # bind the IP to the host with security port filters
  port:
    type: OS::Neutron::Port
    properties:
      security_groups:
      - {get_resource: security_group}
      network: {get_param: fixed_network}
      fixed_ips:
      - subnet: {get_param: fixed_subnet}
      replacement_policy: AUTO

  # Define network access policy for access to the laod balancer
  security_group:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
      - protocol: icmp
      - protocol: tcp
        port_range_min: 8443
        port_range_max: 8443
      - protocol: tcp
        port_range_min: 443
        port_range_max: 443
      - protocol: tcp
        port_range_min: 80
        port_range_max: 80
      - protocol: tcp
        port_range_min: 22
        port_range_max: 22

  # The VM which will host the load balancer service
  host:
    type: OS::Nova::Server
    properties:
      name:
        str_replace:
          template: "%stack_name%-%hostname%.%domainname%"
          params:
            '%stack_name%': {get_param: stack_name}
            '%hostname%': {get_param: hostname}
            '%domainname%': {get_param: domain_name}
      admin_user: {get_param: ssh_user}
      image: {get_param: image}
      flavor: {get_param: flavor}
      key_name: {get_param: key_name}
      networks:
      - port: {get_resource: port}
      user_data_format: SOFTWARE_CONFIG
      user_data_update_policy: IGNORE
      user_data: {get_resource: init}

  # Collect a set of host configuration information in a single structure
  init:
    type: OS::Heat::MultipartMime
    properties:
      parts:
      - config: {get_resource: set_hostname}
      - config: {get_resource: included_files}
      - config: {get_resource: update_ca_cert}
      - config: {get_resource: rhn_register}
      - config: {get_resource: set_extra_repos}
      - config: {get_resource: set_extra_docker_repos}
      - config: {get_resource: host_update}
      - config: {get_resource: add_dns_record}
      - config: {get_resource: add_wildcard_record}
      - config: {get_resource: lb_boot}

  # Compose the FQDN and set the hostname in the cloud-init data structure
  set_hostname:
    type: OS::Heat::CloudConfig
    properties:
      cloud_config:
        hostname:
          str_replace:
            template: "%stack_name%-%hostname%"
            params:
              '%stack_name%': {get_param: stack_name}
              '%hostname%': {get_param: hostname}
        fqdn:
          str_replace:
            template: "%stack_name%-%hostname%.%domainname%"
            params:
              '%stack_name%': {get_param: stack_name}
              '%hostname%': {get_param: hostname}
              '%domainname%': {get_param: domain_name}

  # Compile a set of standard configuration files to provide identity and access
  included_files:
    type: OS::Heat::CloudConfig
    properties:
      cloud_config:
        write_files:
        - path: /usr/bin/retry
          permissions: 0755
          content: {get_file: fragments/retry.sh}
        - path: /usr/local/bin/update_dns
          permissions: 0755
          content: {get_file: fragments/update_dns.py}
        - path: /usr/local/share/openshift-on-openstack/common_functions.sh
          permissions: 0755
          content:
            str_replace:
              params:
                $WC_NOTIFY: { get_attr: ['wait_handle', 'curl_cli'] }
              template: {get_file: fragments/common_functions.sh}
        - path: /etc/pki/ca-trust/source/anchors/ca.crt
          permissions: 0600
          content: {get_param: ca_cert}
        ssh_authorized_keys:
        - {get_param: ansible_public_key}

  # Add CA Cert to trust chain
  update_ca_cert:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $CA_CERT: {get_param: ca_cert}
          template: {get_file: fragments/ca_cert.sh}

  # Connect to a software source for updates on RHEL
  rhn_register:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $OCP_VERSION: {get_param: ocp_version}
            $RHN_USERNAME: {get_param: rhn_username}
            $RHN_PASSWORD: {get_param: rhn_password}
            $SAT6_HOSTNAME: {get_param: sat6_hostname}
            $SAT6_ORGANIZATION: {get_param: sat6_organization}
            $SAT6_ACTIVATIONKEY: {get_param: sat6_activationkey}
            $POOL_ID: {get_param: rhn_pool}
            $EXTRA_POOL_IDS:
              list_join:
                - " --pool="
                - {get_param: extra_rhn_pools}
          template: {get_file: fragments/rhn-register.sh}

  # Enable any extra repositories
  set_extra_repos:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $REPOLIST:
              list_join:
                - " "
                - {get_param: extra_repository_urls}
          template: {get_file: fragments/set-extra-repos.sh}

  set_extra_docker_repos:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            $REPOLIST:
              list_join:
                - " "
                - {get_param: extra_docker_repository_urls}
          template: {get_file: fragments/set-extra-docker-repos.sh}

  # Insure that the host software is current
  host_update:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        get_file: fragments/host-update.sh

  add_dns_record:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            '%ZONE%': {get_param: domain_name}
            '%DNS_SERVER%': {get_param: [dns_servers, 0]}
            '%DNS_UPDATE_KEY%': {get_param: dns_update_key}
            '%IP_ADDRESS%': {get_param: floatingip}
          template: {get_file: fragments/add_dns_record.sh}

  add_wildcard_record:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params:
            '%DNS_ENTRY%': {list_join: ["", ["*.", {get_param: app_subdomain}]]}
            '%ZONE%': {get_param: domain_name}
            '%DNS_SERVER%': {get_param: [dns_servers, 0]}
            '%DNS_UPDATE_KEY%': {get_param: dns_update_key}
            '%IP_ADDRESS%': {get_param: floatingip}
          template: {get_file: fragments/add_dns_record.sh}


  # Prepare the host for SSH access for ansible
  lb_boot:
    type: OS::Heat::SoftwareConfig
    properties:
      config:
        str_replace:
          params: {}
          template: {get_file: fragments/lb-boot.sh}

  node_cleanup:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
      - name: node_name
      - name: node_type
      - name: ssh_user
        default: {get_param: ssh_user}
      outputs:
      - name: result
      config: {get_file: fragments/bastion-node-cleanup.sh}

  # activation hook for removing the node from DNS and from the Kubernetes
  # cluster
  deployment_bastion_node_cleanup:
    depends_on: [host, wait_condition]
    type: OS::Heat::SoftwareDeployment
    properties:
      actions: ['DELETE']
      input_values:
        node_type: loadbalancer
        node_name:
          str_replace:
            template: "%stack_name%-%hostname%.%domainname%"
            params:
              '%stack_name%': {get_param: stack_name}
              '%hostname%': {get_param: hostname}
              '%domainname%': {get_param: domain_name}
      config:
        get_resource: node_cleanup
      server:
        get_param: bastion_node

  # Wait for the load balancer host to complete cloud-init or time out
  wait_condition:
    type: OS::Heat::WaitCondition
    properties:
      handle: {get_resource: wait_handle}
      timeout: {get_param: timeout}

  # Provide a curl CLI to the cloud-init script.  On completion, notify Heat
  wait_handle:
    type: OS::Heat::WaitConditionHandle

outputs:
  console_url:
    description: URL of the OpenShift web console
    value:
      str_replace:
        template: "https://%stack_name%-%hostname%.%domainname%:8443/console/"
        params:
          '%stack_name%': {get_param: stack_name}
          '%hostname%': {get_param: hostname}
          '%domainname%': {get_param: domain_name}

  api_url:
    description: URL entrypoint to the OpenShift API
    value:
      str_replace:
        template: "https://%stack_name%-%hostname%.%domainname%:8443/"
        params:
          '%stack_name%': {get_param: stack_name}
          '%hostname%': {get_param: hostname}
          '%domainname%': {get_param: domain_name}

  hostname:
    description: Loadbalancer hostname
    value:
      str_replace:
        template: "%stack_name%-%hostname%.%domainname%"
        params:
          '%stack_name%': {get_param: stack_name}
          '%hostname%': {get_param: hostname}
          '%domainname%': {get_param: domain_name}