dime.yaml

# Copyright (C) Metaswitch Networks 2017
# If license terms are provided to you in a COPYING file in the root directory
# of the source code repository by which you are accessing this code, then
# the license outlined in that COPYING file applies to your use.
# Otherwise no rights are granted except for those provided to you by
# Metaswitch Networks in a separate written agreement.

heat_template_version: 2013-05-23

description: >
  Clearwater Dime node

parameters:
  public_mgmt_net_id:
    type: string
    description: ID of public management network
    constraints:
      - custom_constraint: neutron.network
        description: Must be a valid network ID
  private_mgmt_net_id:
    type: string
    description: ID of private management network
    constraints:
      - custom_constraint: neutron.network
        description: Must be a valid network ID
  public_sig_net_id:
    type: string
    description: ID of public signaling network
    constraints:
      - custom_constraint: neutron.network
        description: Must be a valid network ID
  private_sig_net_id:
    type: string
    description: ID of private signaling network
    constraints:
      - custom_constraint: neutron.network
        description: Must be a valid network ID
  private_sig_net_cidr:
    type: string
    description: Private signaling network address (CIDR notation)
    default: 192.168.1.0/24
  private_sig_net_gateway:
    type: string
    description: Private signaling network gateway address
    default: 192.168.1.254
  flavor:
    type: string
    description: Flavor to use
    constraints:
      - custom_constraint: nova.flavor
        description: Must be a valid flavor name
  image:
    type: string
    description: Name of image to use
    constraints:
      - custom_constraint: glance.image
        description: Must be a valid image name
  key_name:
    type: string
    description: Name of keypair to assign
    constraints:
      - custom_constraint: nova.keypair
        description: Must be a valid keypair name
  base_mgmt_security_group:
    type: string
    description: ID of base security group for all Clearwater nodes (management)
  dime_sig_security_group:
    type: string
    description: ID of security group for Dime nodes (signaling)
  dime_mgmt_security_group:
    type: string
    description: ID of security group for Dime nodes (management)
  repo_url:
    type: string
    description: URL for Clearwater repository
    default: http://repo.cw-ngv.com/stable
  zone:
    type: string
    description: DNS zone
    default: example.com
  dns_mgmt_ip:
    type: string
    description: IP address for DNS server on management network
  dns_sig_ip:
    type: string
    description: IP address for DNS server on signaling network
  dnssec_key:
    type: string
    description: DNSSEC private key (Base64-encoded)
    constraints:
      - allowed_pattern: "[0-9A-Za-z+/=]+"
        description: Must be Base64-encoded
  etcd_ip:
    type: string
    description: IP address of an existing member of the etcd cluster
    default: ""
  index:
    type: number
    description: Index of this Ralf node in the Ralf cluster
    default: 0

resources:
  mgmt_port:
    type: OS::Neutron::Port
    properties:
      # Specify the network ID by string to work around OpenStack issues - see https://github.com/Metaswitch/clearwater-heat/issues/18.
      network_id: { str_replace: { params: { x: { get_param: private_mgmt_net_id } }, template: x } }
      security_groups:
        - { get_param: base_mgmt_security_group }
        - { get_param: dime_mgmt_security_group }

  mgmt_floating_ip:
    type: OS::Neutron::FloatingIP
    properties:
      floating_network_id: { get_param: public_mgmt_net_id }
      port_id: { get_resource: mgmt_port }

  sig_port:
    type: OS::Neutron::Port
    properties:
      # Specify the network ID by string to work around OpenStack issues - see https://github.com/Metaswitch/clearwater-heat/issues/18.
      network_id: { str_replace: { params: { x: { get_param: private_sig_net_id } }, template: x } }
      security_groups:
        - { get_param: dime_sig_security_group }

  server:
    type: OS::Nova::Server
    properties:
      name: { str_replace: { params: { __index__: { get_param: index }, __zone__: { get_param: zone } }, template: dime-__index__.__zone__ } }
      image: { get_param: image }
      flavor: { get_param: flavor }
      key_name: { get_param: key_name }
      networks:
        - port: { get_resource: mgmt_port }
        - port: { get_resource: sig_port }
      user_data_format: RAW
      user_data:
        str_replace:
          params:
            __repo_url__: { get_param: repo_url }
            __zone__: { get_param: zone }
            __public_mgmt_ip__: { get_attr: [ mgmt_floating_ip, floating_ip_address ] }
            __private_mgmt_ip__: { get_attr: [ mgmt_port, fixed_ips, 0, ip_address ] }
            __private_sig_ip__: { get_attr: [ sig_port, fixed_ips, 0, ip_address ] }
            __private_sig_cidr__: { get_param: private_sig_net_cidr }
            __private_sig_gateway__: { get_param: private_sig_net_gateway }
            __dns_mgmt_ip__: { get_param: dns_mgmt_ip }
            __dns_sig_ip__: { get_param: dns_sig_ip }
            __dnssec_key__: { get_param: dnssec_key }
            __etcd_ip__ : { get_param: etcd_ip }
            __index__ : { get_param: index }
          template: |
            #!/bin/bash

            # Log all output to file.
            exec > >(tee -a /var/log/clearwater-heat-dime.log) 2>&1
            set -x

            # Set up the signaling network namespace on each boot by creating an init file and
            # linking to it from runlevel 2 and 3
            cat >/etc/init.d/signaling_namespace <<EOF
            #!/bin/bash
            # Create the signaling namespace and configure its interfaces.
            set -e

            # Exit if the namespace is already set up.
            ip netns list | grep -q signaling && exit 0

            # eth1 is the signaling interface (and eth0 is the management interface).
            # We need to set eth1 up manually - only eth0 is automatically configured via DHCP.
            ip netns add signaling
            ip link set eth1 netns signaling
            ip netns exec signaling ip link set dev lo up
            ip netns exec signaling ip addr add __private_sig_ip__/$(echo __private_sig_cidr__ | cut -d / -f 2) dev eth1
            ip netns exec signaling ip link set dev eth1 up
            ip netns exec signaling ip route add default via __private_sig_gateway__
            EOF

            chmod a+x /etc/init.d/signaling_namespace
            ln -s /etc/init.d/signaling_namespace /etc/rc2.d/S01signaling_namespace
            ln -s /etc/init.d/signaling_namespace /etc/rc3.d/S01signaling_namespace

            # Also set up the signaling namespace now.
            /etc/init.d/signaling_namespace

            # Configure the APT software source.
            echo 'deb __repo_url__ binary/' > /etc/apt/sources.list.d/clearwater.list
            curl -L http://repo.cw-ngv.com/repo_key | apt-key add -
            apt-get update

            # Configure /etc/clearwater/local_config.
            mkdir -p /etc/clearwater
            etcd_ip=__etcd_ip__
            [ -n "$etcd_ip" ] || etcd_ip=__private_mgmt_ip__
            cat > /etc/clearwater/local_config << EOF
            signaling_namespace=signaling
            signaling_dns_server=__dns_sig_ip__
            management_local_ip=__private_mgmt_ip__
            local_ip=__private_sig_ip__
            public_ip=__private_sig_ip__
            public_hostname=dime-__index__.__zone__
            etcd_cluster=$etcd_ip
            EOF

            # Now install the software.
            DEBIAN_FRONTEND=noninteractive apt-get install dime --yes --force-yes
            DEBIAN_FRONTEND=noninteractive apt-get install clearwater-management --yes --force-yes

            # Function to give DNS record type and IP address for specified IP address
            ip2rr() {
              if echo $1 | grep -q -e '[^0-9.]' ; then
                echo AAAA $1
              else
                echo A $1
              fi
            }

            # Update DNS
            retries=0
            while ! { nsupdate -y "__zone__:__dnssec_key__" -v << EOF
            server __dns_mgmt_ip__
            update add dime-__index__.__zone__. 30 $(ip2rr __public_mgmt_ip__)
            update add ralf.__zone__. 30 $(ip2rr __private_sig_ip__)
            update add hs.__zone__. 30 $(ip2rr __private_sig_ip__)
            update add hs-prov.__zone__. 30 $(ip2rr __private_mgmt_ip__)
            send
            EOF
            } && [ $retries -lt 10 ]
            do
              retries=$((retries + 1))
              echo 'nsupdate failed - retrying (retry '$retries')...'
              sleep 5
            done

            # Use the DNS server.
            echo 'nameserver __dns_mgmt_ip__' > /etc/dnsmasq.resolv.conf
            echo 'RESOLV_CONF=/etc/dnsmasq.resolv.conf' >> /etc/default/dnsmasq
            mkdir -p /etc/netns/signaling
            echo 'nameserver __dns_sig_ip__' > /etc/netns/signaling/resolv.conf
            service dnsmasq force-reload

outputs:
  public_mgmt_ip:
    description: IP address in public (management) network
    value: { get_attr: [ mgmt_floating_ip, floating_ip_address ] }
  private_mgmt_ip:
    description: IP address in private signaling network
    value: { get_attr: [ mgmt_port, fixed_ips, 0, ip_address ] }
  private_sig_ip:
    description: IP address in private signaling network
    value: { get_attr: [ sig_port, fixed_ips, 0, ip_address ] }