BZ #1123314 - pacemaker heat op monitor interval to 60s

https://bugzilla.redhat.com/show_bug.cgi?id=1123314

From BZ: "Rubygem-staypuft: HA: Relax the openstack-heat-engine: op
monitor interval to 60 seconds.

Now it's openstack-heat-engine: op monitor interval=30s

appears to be too resource consuming in some cases (like
openstack-heat-engine and causes false positives."
BZ #1123300 - haproxy check options missing interval parameter

https://bugzilla.redhat.com/show_bug.cgi?id=1123300

From BZ: "HA: all "check" options are missing the interval
parameter. This can cause higher recovery times in case of failure."
BZ #1123312 - increase galera pacemaker start timeout

https://bugzilla.redhat.com/show_bug.cgi?id=1123312

Increase galera start timeout to allow a sufficient amount
of time for syncing to occur between galera modes.
BZ #1129227 - Set l3 external_network_bridge to ''.

https://bugzilla.redhat.com/show_bug.cgi?id=1129227

This is needed to properly use provider networks in newer versions of neutron.
BZ #1128457 - Horizon dashboard -> Not Found

https://bugzilla.redhat.com/show_bug.cgi?id=1128457

Fix 404 on horizon dashboard.

Same fix as posted for packstack (thanks ichavero):
https://bugzilla.redhat.com/show_bug.cgi?id=1129379
https://review.openstack.org/#/c/113592
BZ #1123301 - nova-metadata VIP/listener is missing on port 8775 in haproxy.cfg

https://bugzilla.redhat.com/show_bug.cgi?id=1123301

This was already in the puppet, but had been disabled for a previous release.
This patch re-enables it to see if it now works as expected.
BZ #1123301 - add metadata_listen param

https://bugzilla.redhat.com/show_bug.cgi?id=1123301

Otherwise openstack-nova-api attempts to listen on 0.0.0.0,
causing the error:

ERROR nova.wsgi [-] Could not bind to 0.0.0.0:8775
CRITICAL nova [-] error: [Errno 98] Address already in use

(cherry picked from commit 73a342aeabb03d66d7a26e508183c90ddf72f468)
updated pacemaker/neutron.pp manifests to do ovs/netns cleanups.

Using ocf scripts the cleanups handle the cleanup of agent
resources (qrouter, qdhcp, etc..) when those are migrated to
different hosts.
BZ #1120602 - Add neutron-agent-cleanup ocf resources to Pacemaker config.

https://bugzilla.redhat.com/show_bug.cgi?id=1120602

The quickstack resource wrapper is needed for the previous patch to work properly.
BZ #1128361 - Correctly check for openstack-heat-engine service

https://bugzilla.redhat.com/show_bug.cgi?id=1128361

Use Quickstack::Pacemaker::Resource::Service instead of Exec to check
that heat engine is up
BZ#1122701 - Incoming ports are wide open

https://bugzilla.redhat.com/show_bug.cgi?id=1122701

Uninstall firewalld. The firewall puppet module will then take care of
installing iptables-services package and enabling and starting of
iptables. Default firewall rules will then be present.

Moving the disabling of firewalld to firewall::common so that it's
also ran for the Gluster server host group.
Ensure iptables runs before setting firewall rules

It used to happen that some firewall rules tried to be created before
iptables service was actually running, resulting in failure to create
the rules and printing warnings like:

Warning: Firewall[001 apache incoming](provider=iptables): Unable to persist firewall rules: Execution of '/usr/libexec/iptables/iptables.init save' returned 1:

This issue specifically appeared for apache, nova, and glance firewall
rules on the HA controller.

After updating firewall module, the warnings were not printed but the
iptables service was still getting started after some firewall rules
were defined by Puppet, and this caused the system default firewall
rules not to be present at all.

It seems we need to add ordering on every firewall resource definition
to really ensure that iptables service is started before the first
firewall rule is defined by Puppet.
BZ #1125301 - Add heat-engine to cloudwatch colo constraint

https://bugzilla.redhat.com/show_bug.cgi?id=1125301

Add a colocation constraint from heat-engine to heat-api-cloudwatch

jayg: changed resource name to 'openstack-heat-api-cloudwatch-clone' and verifed
functional.

Signed-off-by: Jason Guiditta <jguiditt@redhat.com>
BZ #1130304 - nfs-utils should be installed before using nfs

https://bugzilla.redhat.com/show_bug.cgi?id=1130304

Make sure nfs-utils is installed and the selinux bit flipped (if
applicable) before attempting to nfs mount something in glance or
cinder.
BZ#1129896 - HA: openstack-heat-engine fails to start

https://bugzilla.redhat.com/show_bug.cgi?id=1129896

Class[quickstack::heat] needs to contain ::heat and ::heat::engine,
otherwise the ordering in Class[quickstack::pacemaker::heat] doesn't
necessarily work as one might expect.
BZ #1132155 - galera stoppped before pcs resource added

https://bugzilla.redhat.com/show_bug.cgi?id=1132155

first puppet run now stops galera before pcs resource added

this only happens in the first puppet run, when
$::galera_bootstrap_ok is "true".
BZ #1132155 - galera add a clustercheck after pacemaker

https://bugzilla.redhat.com/show_bug.cgi?id=1132155

Add a clustercheck as the last action in the galera manifest.  Other
services that rely on galera being up should rely on this event.
BZ #1132155 - Openstack services fail when galera not fully running.

https://bugzilla.redhat.com/show_bug.cgi?id=1132155

This is an additional enforcement of ordering, to make sure the galera module
has done everything it is supposed to when we expect it has. Some dependencies
could have happened out of order without this addition.
Add facts for host pacemaker properties

This exposes some pacemaker property information through facter.
There are two main types.

(1) For each cluster member, a fact named pcs_props_<member name>,
which is a comma-separated string similar to the output of "pcs
property show".

(2) For each cluster service, a fact named pcs_setup_<service name>,
which is a boolean indicating whether that service is present on *all*
cluster members.
BZ #1127863 - ceph client config

https://bugzilla.redhat.com/show_bug.cgi?id=1127863

Add parameters to controller and compute manifests to allow management
of:

  /etc/ceph/ceph.conf,
  /etc/ceph/ceph.client.images.keyring
  /etc/ceph/ceph.client.volumes.keyring

and add virsh secret-define for rbd