heat_template_version: wallaby description: > OpenStack Glance service configured with Puppet parameters: ServiceData: default: {} description: Dictionary packing service data type: json ServiceNetMap: default: {} description: Mapping of service_name -> network name. Typically set via parameter_defaults in the resource registry. Use parameter_merge_strategies to merge it with the defaults. type: json RoleName: default: '' description: Role name on which the service is applied type: string RoleParameters: default: {} description: Parameters specific to the role type: json EndpointMap: default: {} description: Mapping of service endpoint -> protocol. Typically set via parameter_defaults in the resource registry. type: json DeployIdentifier: default: '' type: string description: > Setting this to a unique value will re-run any deployment tasks which perform configuration on a Heat stack-update. Debug: default: false description: Set to True to enable debugging on all services. type: boolean GlanceDebug: default: false description: Set to True to enable debugging Glance service. type: boolean EnableSQLAlchemyCollectd: type: boolean description: > Set to true to enable the SQLAlchemy-collectd server plugin default: false GlancePassword: description: The password for the glance service and db account, used by the glance services. type: string hidden: true GlanceWorkers: default: '' description: | Number of API worker processes for Glance. If left unset (empty string), the default value will result in the configuration being left unset and a system-dependent default value will be chosen (e.g.: number of processors). Please note that this will create a large number of processes on systems with a large number of CPUs resulting in excess memory consumption. It is recommended that a suitable non-default value be selected on such systems. type: string GlanceThreads: type: number description: Set the number of threads for glance::wsgi::apache default: 10 MonitoringSubscriptionGlanceApi: default: 'overcloud-glance-api' type: string GlanceApiLoggingSource: type: json default: tag: openstack.glance.api file: /var/log/containers/glance/api.log GlanceImageMemberQuota: default: 128 description: | Maximum number of image members per image. Negative values evaluate to unlimited. type: number GlanceNfsEnabled: default: false description: > When using GlanceBackend 'file', mount NFS share for image storage. type: boolean GlanceCacheEnabled: description: Enable Glance Image Cache type: boolean default: False GlanceImageCacheDir: description: Base directory that the Image Cache uses type: string default: '/var/lib/glance/image-cache' GlanceImageCacheMaxSize: description: > The upper limit on cache size, in bytes, after which the cache-pruner cleans up the image cache. type: number default: 10737418240 GlanceImageCacheStallTime: description: > The amount of time, in seconds, to let an image remain in the cache without being accessed. type: number default: 86400 GlanceImagePrefetcherInterval: description: > The interval in seconds to run periodic job cache_images. type: number default: 300 GlanceNfsShare: default: '' description: > NFS share to mount for image storage (when GlanceNfsEnabled is true) type: string GlanceNetappNfsEnabled: default: false description: > When using GlanceBackend 'file', Netapp mount NFS share for image storage. type: boolean NetappShareLocation: default: '' description: > Netapp share to mount for image storage (when GlanceNetappNfsEnabled is true) type: string GlanceNfsOptions: default: '_netdev,bg,intr,context=system_u:object_r:container_file_t:s0' description: > NFS mount options for image storage (when GlanceNfsEnabled is true) type: string GlanceRbdPoolName: default: images type: string NovaEnableRbdBackend: default: false description: Whether to enable the Rbd backend for Nova ephemeral storage. type: boolean tags: - role_specific # We default import plugins list to 'no_op' (instead of empty list) to discern from the scenario # in which the user purposely disabled all plugins setting it to an empty list. This is useful # to automatically enable image_conversion plugin only when value is left to the default. GlanceImageImportPlugins: default: ['no_op'] description: > List of enabled Image Import Plugins. Valid values in the list are 'image_conversion', 'inject_metadata', 'no_op'. type: comma_delimited_list GlanceDiskFormats: default: '' description: > List of allowed disk formats in Glance; all formats are allowed when left unset. type: comma_delimited_list GlanceImageConversionOutputFormat: default: 'raw' description: Desired output format for image conversion plugin. type: string GlanceInjectMetadataProperties: default: '' description: Metadata properties to be injected in image. type: comma_delimited_list GlanceIgnoreUserRoles: default: 'admin' description: List of user roles to be ignored for injecting image metadata properties. type: comma_delimited_list GlanceEnabledImportMethods: default: 'web-download' description: > List of enabled Image Import Methods. Valid values in the list are 'glance-direct', 'web-download', or 'copy-image' type: comma_delimited_list GlanceStagingNfsShare: default: '' description: > NFS share to mount for image import staging type: string GlanceNodeStagingUri: default: 'file:///var/lib/glance/staging' description: > URI that specifies the staging location to use when importing images type: string GlanceStagingNfsOptions: default: '_netdev,bg,intr,context=system_u:object_r:container_file_t:s0' description: > NFS mount options for NFS image import staging type: string GlanceSparseUploadEnabled: default: false description: > When using GlanceBackend 'file' and 'rbd' to enable or not sparse upload. type: boolean EnforceSecureRbac: type: boolean default: false description: >- Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting `[oslo_policy] enforce_new_defaults` and `[oslo_policy] enforce_scope` to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. KeystoneRegion: type: string default: 'regionOne' description: Keystone region for endpoint GlanceApiPolicies: description: | A hash of policies to configure for Glance API. e.g. { glance-context_is_admin: { key: context_is_admin, value: 'role:admin' } } default: {} type: json GlanceApiWsgiTimeout: default: 600 description: The number of seconds until a Glance API WSGI connection times out. type: number NotificationDriver: type: comma_delimited_list default: 'noop' description: Driver or drivers to handle sending notifications. EnableInternalTLS: type: boolean default: false GlanceNotifierStrategy: description: Strategy to use for Glance notification queue type: string default: noop GlanceLogFile: description: The filepath of the file to use for logging messages from Glance. type: string default: '' GlanceBackend: default: swift description: The short name of the Glance backend to use. Should be one of swift, rbd, cinder, or file type: string constraints: - allowed_values: ['swift', 'file', 'rbd', 'cinder'] GlanceBackendID: type: string default: 'default_backend' description: The default backend's identifier. constraints: - allowed_pattern: "[a-zA-Z0-9_-]+" GlanceStoreDescription: type: string default: 'Default glance store backend.' description: User facing description for the Glance backend. GlanceMultistoreConfig: type: json default: {} description: | Dictionary of settings when configuring additional glance backends. The hash key is the backend ID, and the value is a dictionary of parameter values unique to that backend. Multiple rbd and cinder backends are allowed, but file and swift backends are limited to one each. Example: # Default glance store is rbd. GlanceBackend: rbd GlanceStoreDescription: 'Default rbd store' # GlanceMultistoreConfig specifies a second rbd backend, plus a cinder # backend. GlanceMultistoreConfig: rbd2_store: GlanceBackend: rbd GlanceStoreDescription: 'Second rbd store' CephClusterName: ceph2 # Override CephClientUserName if this cluster uses a different # client name. CephClientUserName: client2 cinder1_store: GlanceBackend: cinder GlanceCinderVolumeType: 'volume-type-1' GlanceStoreDescription: 'First cinder store' cinder2_store: GlanceBackend: cinder GlanceCinderVolumeType: 'volume-type-2' GlanceStoreDescription: 'Seconde cinder store' GlanceCinderMountPointBase: default: '/var/lib/glance/mnt' type: string description: | The mount point base when glance is using cinder as store and cinder backend is NFS. This mount point is where the NFS volume is mounted on the glance node. GlanceCinderVolumeType: default: '' type: string description: | A unique volume type required for each cinder store while configuring multiple cinder stores as glance backends. The same volume types must be configured in Cinder as well. The volume type must exist in cinder prior to any attempt to add an image in the associated cinder store. If no volume type is specified then cinder's default volume type will be used. GlanceCinderLockPath: default: '/var/lib/cinder/tmp' type: string description: | The oslo.coordination lock_path to use when glance is using cinder as a store. Using cinder's lock_path ensures os-brick operations are synchronized across both services. CephClientUserName: default: openstack type: string CephClusterName: type: string default: ceph description: The Ceph cluster name. constraints: - allowed_pattern: "[a-zA-Z0-9]+" description: > The Ceph cluster name must be at least 1 character and contain only letters and numbers. CephConfigPath: type: string default: "/var/lib/tripleo-config/ceph" description: | The path where the Ceph Cluster config files are stored on the host. MultipathdEnable: default: false description: Whether to enable the multipath daemon type: boolean GlanceApiOptVolumes: default: [] description: list of optional volumes to be mounted type: comma_delimited_list ContainerGlanceApiImage: description: image type: string tags: - role_specific ContainerGlanceApiConfigImage: description: The container image to use for the glance_api config_volume type: string tags: - role_specific GlanceCronDbPurgeMinute: type: string description: > Cron to purge db entries marked as deleted and older than $age - Minute default: '1' GlanceCronDbPurgeHour: type: string description: > Cron to purge db entries marked as deleted and older than $age - Hour default: '0' GlanceCronDbPurgeMonthday: type: string description: > Cron to purge db entries marked as deleted and older than $age - Month Day default: '*' GlanceCronDbPurgeMonth: type: string description: > Cron to purge db entries marked as deleted and older than $age - Month default: '*' GlanceCronDbPurgeWeekday: type: string description: > Cron to purge db entries marked as deleted and older than $age - Week Day default: '*' GlanceCronDbPurgeUser: type: string description: > Cron to purge db entries marked as deleted and older than $age - User default: 'glance' GlanceCronDbPurgeAge: type: string description: > Cron to purge db entries marked as deleted and older than $age - Age default: '30' GlanceCronDbPurgeMaxRows: type: string description: > Cron to purge db entries marked as deleted and older than $age - Max Rows default: '100' GlanceCronDbPurgeDestination: type: string description: > Cron to purge db entries marked as deleted and older than $age - Log destination default: '/var/log/glance/glance-rowsflush.log' GlanceCronDbPurgeMaxDelay: type: string description: > Cron to purge db entries marked as deleted and older than $age - Max Delay default: '3600' MemcacheUseAdvancedPool: type: boolean description: | Use the advanced (eventlet safe) memcached client pool. default: true # DEPRECATED: the following options are deprecated and are currently maintained # for backwards compatibility. They will be removed in future release. GlanceShowMultipleLocations: default: false description: | Whether to show multiple image locations e.g for copy-on-write support on RBD or Netapp backends. Potential security risk, see glance.conf for more information. type: boolean parameter_groups: - label: deprecated description: | The following parameters are deprecated and will be removed. They should not be relied on for new deployments. parameters: - GlanceShowMultipleLocations conditions: cinder_backend_enabled: or: - equals: - get_param: GlanceBackend - cinder - yaql: expression: $.data.values().any($.get("GlanceBackend", "") = "cinder") data: {get_param: GlanceMultistoreConfig} cinder_multipathd_enabled: and: - cinder_backend_enabled - get_param: MultipathdEnable rbd_backend_enabled: or: - equals: - get_param: GlanceBackend - rbd - yaql: expression: $.data.values().any($.get("GlanceBackend", "") = "rbd") data: {get_param: GlanceMultistoreConfig} force_image_conversion_plugin: or: - and: - rbd_backend_enabled - equals: [{get_param: GlanceImageImportPlugins}, ['no_op']] - {get_param: NovaEnableRbdBackend} - {get_param: GlanceSparseUploadEnabled} glance_workers_set: not: {equals : [{get_param: GlanceWorkers}, '']} glance_multiple_locations: or: - {get_param: GlanceShowMultipleLocations} - {get_param: GlanceNetappNfsEnabled} - and: # Keep this for compat, but ignore NovaEnableRbdBackend if it's a role param - rbd_backend_enabled - get_param: NovaEnableRbdBackend resources: ContainersCommon: type: ../containers-common.yaml MySQLClient: type: ../database/mysql-client.yaml GlanceLogging: type: OS::TripleO::Services::Logging::GlanceApi CinderNVMeOF: type: ../cinder/cinder-backend-nvmeof-puppet.yaml ApacheServiceBase: type: ../../deployment/apache/apache-baremetal-puppet.yaml properties: ServiceData: {get_param: ServiceData} ServiceNetMap: {get_param: ServiceNetMap} EndpointMap: {get_param: EndpointMap} RoleName: {get_param: RoleName} RoleParameters: {get_param: RoleParameters} EnableInternalTLS: {get_param: EnableInternalTLS} RoleParametersValue: type: OS::Heat::Value properties: type: json value: map_replace: - map_replace: - ContainerGlanceApiImage: ContainerGlanceApiImage ContainerGlanceApiConfigImage: ContainerGlanceApiConfigImage - values: {get_param: [RoleParameters]} - values: ContainerGlanceApiImage: {get_param: ContainerGlanceApiImage} ContainerGlanceApiConfigImage: {get_param: ContainerGlanceApiConfigImage} outputs: glance_api_host_prep_and_system_upgrade_post_tasks: description: Common host_prep and system_upgrade post tasks for glance_api value: &glance_api_host_prep_and_system_upgrade_post_tasks - name: Mount NFS on host vars: nfs_backend_enabled: {get_param: GlanceNfsEnabled} glance_netapp_nfs_enabled: {get_param: GlanceNetappNfsEnabled} glance_nfs_share: {get_param: GlanceNfsShare} netapp_share_location: {get_param: NetappShareLocation} nfs_share: "{{ glance_nfs_share if (glance_nfs_share) else netapp_share_location }}" nfs_options: {get_param: GlanceNfsOptions} mount: name: /var/lib/glance/images state: mounted fstype: nfs src: "{{nfs_share}}" opts: "{{nfs_options}}" when: nfs_backend_enabled or glance_netapp_nfs_enabled - name: Mount Node Staging Location vars: glance_node_staging_uri: {get_param: GlanceNodeStagingUri} glance_staging_nfs_share: {get_param: GlanceStagingNfsShare} glance_nfs_options: {get_param: GlanceStagingNfsOptions} # Gleaning mount point by stripping "file://" prefix from staging uri mount: name: "{{glance_node_staging_uri[7:]}}" state: mounted fstype: nfs src: "{{glance_staging_nfs_share}}" opts: "{{glance_nfs_options}}" when: glance_staging_nfs_share != '' role_data: description: Role data for the Glance API role. value: service_name: glance_api firewall_rules: '112 glance_api': dport: - 9292 firewall_frontend_rules: '100 glance_api_haproxy_frontend': dport: - 9292 firewall_ssl_frontend_rules: '100 glance_api_haproxy_frontend_ssl': dport: - 13292 keystone_resources: glance: endpoints: public: {get_param: [EndpointMap, GlancePublic, uri]} internal: {get_param: [EndpointMap, GlanceInternal, uri]} admin: {get_param: [EndpointMap, GlanceAdmin, uri]} users: glance: password: {get_param: GlancePassword} region: {get_param: KeystoneRegion} service: 'image' monitoring_subscription: {get_param: MonitoringSubscriptionGlanceApi} config_settings: map_merge: - get_attr: [ApacheServiceBase, role_data, config_settings] - glance::api::db::database_connection: make_url: scheme: {get_param: [EndpointMap, MysqlInternal, protocol]} username: glance password: {get_param: GlancePassword} host: {get_param: [EndpointMap, MysqlInternal, host]} path: /glance query: if: - {get_param: EnableSQLAlchemyCollectd} - read_default_file: /etc/my.cnf.d/tripleo.cnf read_default_group: tripleo plugin: collectd collectd_program_name: glance collectd_host: localhost - read_default_file: /etc/my.cnf.d/tripleo.cnf read_default_group: tripleo glance::api::authtoken::www_authenticate_uri: {get_param: [EndpointMap, KeystonePublic, uri_no_suffix] } glance::api::authtoken::auth_url: { get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] } glance::api::enable_v1_api: false glance::api::enable_v2_api: true glance::api::authtoken::password: {get_param: GlancePassword} glance::api::enable_proxy_headers_parsing: true glance::api::logging::debug: if: - {get_param: GlanceDebug} - true - {get_param: Debug} glance::policy::policies: {get_param: GlanceApiPolicies} glance::api::authtoken::project_name: 'service' glance::api::authtoken::region_name: {get_param: KeystoneRegion} glance::api::authtoken::user_domain_name: 'Default' glance::api::authtoken::project_domain_name: 'Default' glance::api::authtoken::interface: 'internal' glance::api::authtoken::memcache_use_advanced_pool: {get_param: MemcacheUseAdvancedPool} glance::api::pipeline: if: - {get_param: GlanceCacheEnabled} - 'keystone+cachemanagement' - 'keystone' glance::api::os_region_name: {get_param: KeystoneRegion} glance::api::image_member_quota: {get_param: GlanceImageMemberQuota} glance::api::enabled_import_methods: {get_param: GlanceEnabledImportMethods} glance::api::node_staging_uri: {get_param: GlanceNodeStagingUri} glance::api::image_import_plugins: if: - force_image_conversion_plugin - list_concat_unique: - {get_param: GlanceImageImportPlugins} - ['image_conversion'] - {get_param: GlanceImageImportPlugins} glance::api::image_conversion_output_format: {get_param: GlanceImageConversionOutputFormat} glance::api::inject_metadata_properties: {get_param: GlanceInjectMetadataProperties} glance::api::ignore_user_roles: {get_param: GlanceIgnoreUserRoles} glance::api::bind_host: str_replace: template: "%{hiera('fqdn_$NETWORK')}" params: $NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]} glance::api::service_name: httpd glance::wsgi::apache::threads: {get_param: GlanceThreads} glance::wsgi::apache::ssl: {get_param: EnableInternalTLS} glance::wsgi::apache::bind_host: str_replace: template: "%{hiera('$NETWORK')}" params: $NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]} glance::wsgi::apache::servername: str_replace: template: "%{hiera('fqdn_$NETWORK')}" params: $NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]} glance::wsgi::apache::vhost_custom_fragment: list_join: # Join with additional whitespace for proper indentation. - "\n " - - "LimitRequestBody 0" - str_replace: template: "Timeout TIMEOUT" params: TIMEOUT: {get_param: GlanceApiWsgiTimeout} glance_notifier_strategy: {get_param: GlanceNotifierStrategy} glance_log_file: {get_param: GlanceLogFile} glance::backend::rbd::rbd_thin_provisioning: {get_param: GlanceSparseUploadEnabled} glance::backend::file::filesystem_thin_provisioning: {get_param: GlanceSparseUploadEnabled} glance::backend::swift::swift_store_auth_address: {get_param: [EndpointMap, KeystoneV3Internal, uri] } glance::backend::swift::swift_store_user: service:glance glance::backend::swift::swift_store_key: {get_param: GlancePassword} glance::backend::swift::swift_store_create_container_on_put: true glance::backend::swift::swift_store_auth_version: 3 glance::backend::rbd::rbd_store_ceph_conf: list_join: - '' - - '/etc/ceph/' - {get_param: CephClusterName} - '.conf' glance::backend::rbd::rbd_store_pool: {get_param: GlanceRbdPoolName} glance::backend::rbd::rbd_store_user: {get_param: CephClientUserName} glance_backend: {get_param: GlanceBackend} tripleo::profile::base::glance::api::glance_backend_id: {get_param: GlanceBackendID} tripleo::profile::base::glance::api::glance_enable_wsgi: true tripleo::profile::base::glance::api::glance_store_description: {get_param: GlanceStoreDescription} tripleo::profile::base::glance::api::multistore_config: {get_param: GlanceMultistoreConfig} tripleo::profile::base::glance::backend::rbd::glance_rbd_ceph_conf_path: {get_param: CephConfigPath} glance::notify::rabbitmq::notification_driver: {get_param: NotificationDriver} glance::notify::rabbitmq::rabbit_heartbeat_in_pthread: false glance::cron::db_purge::minute: {get_param: GlanceCronDbPurgeMinute} glance::cron::db_purge::hour: {get_param: GlanceCronDbPurgeHour} glance::cron::db_purge::monthday: {get_param: GlanceCronDbPurgeMonthday} glance::cron::db_purge::month: {get_param: GlanceCronDbPurgeMonth} glance::cron::db_purge::weekday: {get_param: GlanceCronDbPurgeWeekday} glance::cron::db_purge::user: {get_param: GlanceCronDbPurgeUser} glance::cron::db_purge::age: {get_param: GlanceCronDbPurgeAge} glance::cron::db_purge::max_rows: {get_param: GlanceCronDbPurgeMaxRows} glance::cron::db_purge::destination: {get_param: GlanceCronDbPurgeDestination} glance::cron::db_purge::maxdelay: {get_param: GlanceCronDbPurgeMaxDelay} - if: - glance_workers_set - glance::wsgi::apache::workers: {get_param: GlanceWorkers} - if: - {get_param: EnforceSecureRbac} - glance::api::enforce_secure_rbac: true glance::policy::enforce_new_defaults: true - if: - cinder_backend_enabled - glance::backend::cinder::cinder_store_auth_address: {get_param: [EndpointMap, KeystoneV3Internal, uri]} glance::backend::cinder::cinder_store_project_name: 'service' glance::backend::cinder::cinder_store_user_name: 'glance' glance::backend::cinder::cinder_store_password: {get_param: GlancePassword} glance::api::lock_path: {get_param: GlanceCinderLockPath} tripleo::profile::base::glance::backend::cinder::cinder_mount_point_base: {get_param: GlanceCinderMountPointBase} tripleo::profile::base::glance::backend::cinder::cinder_volume_type: {get_param: GlanceCinderVolumeType} - if: - cinder_multipathd_enabled - glance::backend::cinder::cinder_use_multipath: true - if: - {get_param: GlanceCacheEnabled} - tripleo::profile::base::glance::api::glance_enable_cache: true glance::api::image_cache_dir: {get_param: GlanceImageCacheDir} glance::api::image_cache_max_size: {get_param: GlanceImageCacheMaxSize} glance::api::image_cache_stall_time: {get_param: GlanceImageCacheStallTime} glance::api::cache_prefetcher_interval: {get_param: GlanceImagePrefetcherInterval} - if: - {get_param: GlanceNetappNfsEnabled} - tripleo::profile::base::glance::netapp::netapp_share: {get_param: NetappShareLocation} glance::api::filesystem_store_metadata_file: '/etc/glance/glance-metadata-file.json' glance::api::filesystem_store_file_perm: '0644' - if: - contains: ['glance-direct', {get_param: GlanceEnabledImportMethods}] - glance::api::worker_self_reference_url: if: - {get_param: EnableInternalTLS} - str_replace: template: "https://%{hiera('fqdn_NETWORK')}:PORT" params: NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]} PORT: {get_param: [EndpointMap, GlanceInternal, port]} - str_replace: template: "http://%{hiera('NETWORK_uri')}:PORT" params: NETWORK: {get_param: [ServiceNetMap, GlanceApiNetwork]} PORT: {get_param: [EndpointMap, GlanceInternal, port]} - if: - not: {equals: [{get_param: GlanceDiskFormats}, []]} - glance::api::disk_formats: {get_param: GlanceDiskFormats} service_config_settings: mysql: glance::db::mysql::password: {get_param: GlancePassword} glance::db::mysql::user: glance glance::db::mysql::host: '%' glance::db::mysql::dbname: glance rsyslog: tripleo_logging_sources_glance_api: - {get_param: GlanceApiLoggingSource} # BEGIN DOCKER SETTINGS # puppet_config: config_volume: glance_api puppet_tags: glance_api_config,glance_api_paste_ini,glance_swift_config,glance_cache_config,glance_image_import_config step_config: list_join: - "\n" - - include tripleo::profile::base::glance::api - if: - {get_param: GlanceNetappNfsEnabled} - include tripleo::profile::base::glance::netapp - {get_attr: [MySQLClient, role_data, step_config]} config_image: {get_attr: [RoleParametersValue, value, ContainerGlanceApiConfigImage]} kolla_config: /var/lib/kolla/config_files/glance_api.json: command: /usr/sbin/httpd -DFOREGROUND config_files: - source: "/var/lib/kolla/config_files/src/etc/httpd/conf.d" dest: "/etc/httpd/conf.d" merge: false preserve_properties: true - source: "/var/lib/kolla/config_files/src/etc/httpd/conf.modules.d" dest: "/etc/httpd/conf.modules.d" merge: false preserve_properties: true - source: "/usr/share/glance/glance-api-dist-paste.ini" dest: "/etc/glance/glance-api-paste.ini" merge: true preserve_properties: true - source: "/var/lib/kolla/config_files/src/*" dest: "/" merge: true preserve_properties: true - source: "/var/lib/kolla/config_files/src-tls/*" dest: "/" merge: true preserve_properties: true optional: true - source: "/var/lib/kolla/config_files/src-ceph/" dest: "/etc/ceph/" merge: true preserve_properties: true - source: "/var/lib/kolla/config_files/src-iscsid/*" dest: "/etc/iscsi/" merge: true preserve_properties: true permissions: list_concat: - - path: /var/lib/glance owner: glance:glance recurse: true - path: str_replace: template: /etc/ceph/CLUSTER.client.USER.keyring params: CLUSTER: {get_param: CephClusterName} USER: {get_param: CephClientUserName} owner: glance:glance perm: '0600' - repeat: template: path: /etc/ceph/<%keyring%> owner: glance:glance perm: '0600' for_each: <%keyring%>: yaql: expression: let(u => $.data.user) -> $.data.multistore.values().where($.get("CephClusterName")).select($.CephClusterName + ".client." + $.get("CephClientUserName", $u) +".keyring") data: user: {get_param: CephClientUserName} multistore: {get_param: GlanceMultistoreConfig} /var/lib/kolla/config_files/glance_api_cron.json: command: /usr/sbin/crond -n config_files: - source: "/var/lib/kolla/config_files/src/*" dest: "/" merge: true preserve_properties: true permissions: - path: /var/log/glance owner: glance:glance recurse: true docker_config: step_2: get_attr: [GlanceLogging, docker_config, step_2] step_3: glance_api_db_sync: image: &glance_api_image {get_attr: [RoleParametersValue, value, ContainerGlanceApiImage]} cap_add: - AUDIT_WRITE net: host privileged: false detach: false user: root volumes: &glance_volumes list_concat: - {get_attr: [ContainersCommon, volumes]} - {get_attr: [GlanceLogging, volumes]} - {get_param: GlanceApiOptVolumes} - - /var/lib/kolla/config_files/glance_api.json:/var/lib/kolla/config_files/config.json - /var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro - list_join: - ':' - - {get_param: CephConfigPath} - - '/var/lib/kolla/config_files/src-ceph' - - 'z' - /var/lib/config-data/puppet-generated/iscsid/etc/iscsi:/var/lib/kolla/config_files/src-iscsid:ro - /var/lib/glance:/var/lib/glance:shared - if: - {get_param: EnableInternalTLS} - - /etc/pki/tls/certs/httpd:/etc/pki/tls/certs/httpd:ro - /etc/pki/tls/private/httpd:/etc/pki/tls/private/httpd:ro - if: - cinder_backend_enabled - list_concat: - - /dev:/dev - /var/lib/iscsi:/var/lib/iscsi:z - list_join: - ':' - - {get_param: GlanceCinderLockPath} - {get_param: GlanceCinderLockPath} - 'z' - {get_attr: [CinderNVMeOF, cinder_nvmeof_volumes]} - if: - cinder_multipathd_enabled - - /etc/multipath:/etc/multipath:z - /etc/multipath.conf:/etc/multipath.conf:ro environment: KOLLA_BOOTSTRAP: true KOLLA_CONFIG_STRATEGY: COPY_ALWAYS TRIPLEO_DEPLOY_IDENTIFIER: {get_param: DeployIdentifier} command: "/usr/bin/bootstrap_host_exec glance_api su glance -s /bin/bash -c '/usr/local/bin/kolla_start'" step_4: glance_api: start_order: 2 image: *glance_api_image net: host privileged: true restart: always # User must be root to run httpd, kolla will switch user to 'glance' user: root depends_on: if: - or: - {get_param: GlanceNfsEnabled} - {get_param: GlanceNetappNfsEnabled} - var-lib-glance-images.mount healthcheck: test: /openstack/healthcheck volumes: *glance_volumes environment: KOLLA_CONFIG_STRATEGY: COPY_ALWAYS glance_api_cron: start_order: 2 image: *glance_api_image net: host user: root privileged: false restart: always healthcheck: test: '/usr/share/openstack-tripleo-common/healthcheck/cron glance' volumes: list_concat: - {get_attr: [ContainersCommon, volumes]} - {get_attr: [GlanceLogging, volumes]} - - /var/lib/kolla/config_files/glance_api_cron.json:/var/lib/kolla/config_files/config.json - /var/lib/config-data/puppet-generated/glance_api:/var/lib/kolla/config_files/src:ro - /var/lib/glance:/var/lib/glance:shared environment: KOLLA_CONFIG_STRATEGY: COPY_ALWAYS host_prep_tasks: list_concat: - {get_attr: [GlanceLogging, host_prep_tasks]} - *glance_api_host_prep_and_system_upgrade_post_tasks - - name: ensure ceph configurations exist file: path: {get_param: CephConfigPath} state: directory - name: ensure /var/lib/glance exists file: path: /var/lib/glance state: directory setype: container_file_t - if: - cinder_backend_enabled - - name: Allow glance to use cinder's lock_path file: path: {get_param: GlanceCinderLockPath} state: directory setype: container_file_t mode: 0770 group: 42400 - name: Identify dynamic os-brick lock files used by glance vars: lock_path: {get_param: GlanceCinderLockPath} ansible.builtin.find: paths: "{{ lock_path }}" patterns: "os-brick-connect_to_iscsi_portal-*" register: find_dynamic_locks - name: Prepare the os-brick lock files used by glance vars: lock_path: {get_param: GlanceCinderLockPath} static_brick_locks: - "{{ lock_path }}/os-brick-connect_volume" - "{{ lock_path }}/os-brick-extend_volume" - "{{ lock_path }}/scaleio-scaleio" dynamic_brick_locks: "{{ find_dynamic_locks.files | map(attribute='path') }}" file: path: "{{ item }}" state: touch setype: container_file_t # Glance is a member of the kolla group, so this # allows glance to acquire the lock file. mode: 0660 group: 42400 loop: "{{ (static_brick_locks + dynamic_brick_locks) | flatten}}" - {get_attr: [CinderNVMeOF, cinder_nvmeof_host_prep_tasks]} upgrade_tasks: - name: glance-api pre system_upgrade tasks tags: - never - system_upgrade - system_upgrade_run - system_upgrade_nfsmounts when: - step|int == 3 - upgrade_leapp_enabled block: - name: Unmount and remove NFS glance entry vars: nfs_backend_enabled: {get_param: GlanceNfsEnabled} glance_netapp_nfs_enabled: {get_param: GlanceNetappNfsEnabled} mount: name: /var/lib/glance/images fstype: nfs state: absent when: nfs_backend_enabled or glance_netapp_nfs_enabled - name: Unmount and remove NFS glance-staging entry vars: glance_node_staging_uri: {get_param: GlanceNodeStagingUri} glance_staging_nfs_share: {get_param: GlanceStagingNfsShare} mount: name: "{{glance_node_staging_uri[7:]}}" fstype: nfs state: absent when: glance_staging_nfs_share != '' - name: glance-api post system_upgrade tasks tags: - never - system_upgrade - system_upgrade_run - system_upgrade_nfsmounts when: - step|int == 5 - upgrade_leapp_enabled block: *glance_api_host_prep_and_system_upgrade_post_tasks external_upgrade_tasks: - when: - step|int == 1 tags: - never - system_upgrade_transfer_data - system_upgrade_stop_services block: - name: Stop glance api container import_role: name: tripleo_container_stop vars: tripleo_containers_to_stop: - glance_api - glance_api_cron tripleo_delegate_to: "{{ groups['glance_api'] | difference(groups['excluded_overcloud']) }}"