API tools faq
paste
Guest User

Untitled

a guest
Jun 18th, 2015
270
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 32.17 KB | None | 0 0
raw download clone embed print report
  1. heat_template_version: 2013-05-23
  2.  
  3. description: >
  4. SUMMARY:
  5. HEAT-vDCaaS-Basic-NO-BORRAR.CMC-3.7.4.3
  6.  
  7. TEMPORALLY, to easy the debugging, a permanent key-pair is used (to be removend from the last version)
  8.  
  9. It creates from scratch the infrastructure for a vDCaaS in the "Basic" configuration:
  10. a "Front Office" with 2 "tiny" servers (e.g. example web servers) and 1 "small" server (bastion+contol+other tasks)
  11. and a "Back Office" with "medium" Servers (e.g. Database, FilServer, etc.) environment
  12.  
  13.  
  14. PREVIOUS STEP:
  15. it gathers the parameters to customize the deployemnt
  16.  
  17. FIRST
  18. a Key pair si created to be used in ssh with all the instances
  19. After, it creates Front-Office network and a router to connect it with the public network
  20. This step ends by creating the Back-Office network and a router to connect it with the Front-Office network
  21. SECOND
  22. It builds 2 new Security Groups: one for the external accesible machines (thought for front-office),
  23. and the other one for internal protected machines (thought for back-office)
  24. In the first one, it enables HTTP access via port 80 plus SSH access, besides ping (and all ICMP)
  25. THIRD
  26. First it creates the "front servers" (web servers, for instance) ans accosite to each one a Cinder volume (permanent storage disk)
  27. Finally, it creates 1 bastion server for control and monitoring too. Logically, it's deployed in
  28. the front office network with an private IP address, and and an IP floating addresss
  29. (i.e. IP public addres) is linked to it, too. A volumen is created and associated to this server too.
  30. The image and flavor of the VM are the same than te the ones of "front servers".
  31. FORTH
  32. It creates a load balancer for the "front servers" (for HTTP traffic in standard port).
  33. FITH
  34. It creates the "back servers" (database server, for instance).
  35. Besides it attaches permanent extra disck space (volume from Glance) to the back server.
  36.  
  37. LAST STEP
  38. It ouputs the URLs for triggering the scalin of the front servers, as well as the Public
  39. (floating) IP address of the control server
  40.  
  41. NOTE & DISCLAIMING
  42. This example is used for TISSAT's demos and it has built from a lot of partial examples
  43. publicly available (CCM)
  44.  
  45.  
  46. # PREVIOUS STEP: parameter input
  47.  
  48.  
  49. parameters:
  50.  
  51. DNS_server:
  52. type: string
  53. description: DNS name servers to be used
  54. default: 8.8.8.8
  55.  
  56. # TEMPORALLY, to easy the debugging, a permanent key-pair is used (to be removend from the last version)
  57. temporal_key_name:
  58. type: string
  59. description: Name for key pair to be generated for using in all the instances
  60. default: kp1
  61.  
  62. # TEMPORALLY, to easy the debugging, a permanent key-pair is used (to be removend from the last version)
  63. permanent_key_name:
  64. type: string
  65. description: Name of an existing key pair to use for all the instances
  66. default: clave-permanente
  67. constraints:
  68. - custom_constraint: nova.keypair
  69. description: Must name a public key (pair) known to Nova
  70.  
  71. front_server_image:
  72. type: string
  73. description: >
  74. Name or ID of the image to use for all the front servers.
  75. Any image should work since this template does not ask the VMs to do anything.
  76. It's also used for the Server of Control
  77. # default: cirros
  78. # default: cirros-0.3.2-x86_64-uec
  79. default: cirros-0.3.3-x86_64
  80. constraints:
  81. - custom_constraint: glance.image
  82. description: Must identify an image known to Glance
  83.  
  84. selected_zone:
  85. type: string
  86. description: Name for availability zone where deploying ALL the instances
  87. default: nova
  88.  
  89.  
  90. # parameters for FIFTH step
  91.  
  92. back_server_image:
  93. type: string
  94. description: Name of image to use for servers
  95. # default: cirros
  96. # default: cirros-0.3.2-x86_64-uec
  97. default: cirros-0.3.3-x86_64
  98. constraints:
  99. - custom_constraint: glance.image
  100. description: Must identify an image known to Glance
  101.  
  102.  
  103.  
  104.  
  105. resources:
  106.  
  107. # STEP ZERO: Creation of the 2 Floating IP needed for the project
  108.  
  109. floating_IP_1:
  110. type: OS::Neutron::FloatingIP
  111. properties:
  112. # floating_network: public
  113. floating_network: ext-net
  114. # floating_network: net04_ext
  115.  
  116. floating_IP_2:
  117. type: OS::Neutron::FloatingIP
  118. properties:
  119. # floating_network: public
  120. floating_network: ext-net
  121. # floating_network: net04_ext
  122.  
  123.  
  124.  
  125. # FIRST STEP: logical LANs and routers are created:
  126.  
  127. # a) a public-private key pair is going to be created (for connecting via ssh to all the instances)
  128.  
  129. # TEMPORALLY, to easy the debugging, a permanent key-pair is used (to be removend from the last version), so this key is not used in this tempalte
  130. key_pair:
  131. type: OS::Nova::KeyPair
  132. properties:
  133. name: { get_param: temporal_key_name }
  134. save_private_key: True
  135.  
  136.  
  137. # b) Front-Office network and a router to connect it with the public network
  138.  
  139. private_front_net:
  140. type: OS::Neutron::Net
  141. properties:
  142. name: { list_join: [ '-', ['Red','Frontal', {get_param: "OS::stack_name"}] ] }
  143. # depends_on: [ private_back_net ]
  144. ## "private_back_net" dependency is added in order to forze the order of creation of vLANs, and in consequence how are drawn in the figure
  145.  
  146. private_front_subnet:
  147. type: OS::Neutron::Subnet
  148. properties:
  149. network: { get_resource: private_front_net }
  150. cidr: 192.168.1.0/24
  151. gateway_ip: 192.168.1.1
  152. # allocation_pools:
  153. # - start: 192.168.1.1
  154. # end: 192.168.1.254
  155. dns_nameservers: [ {get_param: DNS_server} ]
  156. enable_dhcp: True
  157. ip_version: 4
  158. name:
  159. str_replace:
  160. template: Sub-$FrontNetName
  161. params:
  162. $FrontNetName: { get_attr: [private_front_net, name] }
  163. depends_on: [ private_front_net ]
  164. # depends_on: [ private_front_net, private_back_net ]
  165. ## "private_back_net" dependency is added in order to forze the order of creation of vLANs, and in consequence how are drawn in the figure
  166.  
  167. front_router:
  168. type: OS::Neutron::Router
  169. properties:
  170. name: Router-Acceso
  171. external_gateway_info:
  172. # network: public
  173. network: Externa
  174. # network: net04_ext
  175. # depends_on: [ private_front_subnet ]
  176.  
  177. front_router_interface:
  178. type: OS::Neutron::RouterInterface
  179. properties:
  180. router_id: { get_resource: front_router }
  181. # router: { get_attr: [front_router, name] }
  182. # subnet: { get_attr: [private_front_subnet, name] }
  183. subnet_id: { get_resource: private_front_subnet }
  184. depends_on: [ front_router, private_front_subnet ]
  185.  
  186. #
  187. # NEW Changes: after creating font office network, then it creates the security group policy por this machines in thios network,
  188. # and after it launchs the instances in the fronto office network, adn finally the load balancer
  189. #
  190. # a) security group for the devices directly accesibe from Internet ("external security group")
  191. external_machines_security_group:
  192. type: OS::Neutron::SecurityGroup
  193. properties:
  194. description: 'Enable HTTP access via port 80 plus SSH access for the external accesible machines (besides of ping)'
  195. name: external_security_group
  196. rules:
  197. # outgoing is allowed for ANY protocol TO ALL FROM ANY device in the "external security group":
  198. - direction: 'egress'
  199. ethertype: 'IPv4'
  200. remote_mode: remote_ip_prefix
  201. remote_ip_prefix: '0.0.0.0/0'
  202. # ingoing is allowed for "pinging" (and ANY ICMP protocol) FROM ALL TO ANY device in the "external security group"
  203. - direction: 'ingress'
  204. ethertype: 'IPv4'
  205. protocol: 'icmp'
  206. remote_mode: remote_ip_prefix
  207. remote_ip_prefix: '0.0.0.0/0'
  208. # ingoing is allowed for ANY protocol FROM ANY device in the "external security group" TO ANY device in the same "external security group"
  209. - direction: 'ingress'
  210. ethertype: 'IPv4'
  211. remote_mode: remote_group_id
  212. # ingoing is allowed for HTTP (in standard port 80) FROM ALL TO ANY device in the "external security group"
  213. - direction: 'ingress'
  214. ethertype: 'IPv4'
  215. protocol: 'tcp'
  216. port_range_max: '80'
  217. port_range_min: '80'
  218. remote_mode: remote_ip_prefix
  219. remote_ip_prefix: '0.0.0.0/0'
  220. # ingoing is allowed for ssh (in standard port 22) FROM ALL TO ANY device in the "external security group"
  221. - direction: 'ingress'
  222. ethertype: 'IPv4'
  223. protocol: 'tcp'
  224. port_range_max: '22'
  225. port_range_min: '22'
  226. remote_mode: remote_ip_prefix
  227. remote_ip_prefix: '0.0.0.0/0'
  228.  
  229. #b) Now the machines in the front-office network
  230. front_server_1:
  231. type: OS::Nova::Server
  232. properties:
  233. name: Front-Server-1
  234. availability_zone: { get_param: selected_zone }
  235. image: { get_param: front_server_image }
  236. flavor: m1.tiny
  237. # key_name: { get_resource: key_pair }
  238. key_name: { get_param: permanent_key_name }
  239. # networks: [{network: {get_param: private_front_net_name} }]
  240. networks: [{network: {get_resource: private_front_net} }]
  241. security_groups:
  242. - external_security_group
  243. depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, external_machines_security_group ]
  244. # depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router, external_machines_security_group ]
  245.  
  246. my_vol_1:
  247. type: OS::Cinder::Volume
  248. properties:
  249. # size: 25
  250. size: 1
  251. vol_att_1:
  252. type: OS::Cinder::VolumeAttachment
  253. properties:
  254. instance_uuid: { get_resource: front_server_1 }
  255. volume_id: { get_resource: my_vol_1 }
  256. # mountpoint: /dev/vdb
  257. depends_on: [ front_server_1, my_vol_1 ]
  258.  
  259. front_server_2:
  260. type: OS::Nova::Server
  261. properties:
  262. name: Front-Server-2
  263. availability_zone: { get_param: selected_zone }
  264. image: { get_param: front_server_image }
  265. flavor: m1.tiny
  266. # key_name: { get_resource: key_pair }
  267. key_name: { get_param: permanent_key_name }
  268. # networks: [{network: {get_param: private_front_net_name} }]
  269. networks: [{network: {get_resource: private_front_net} }]
  270. security_groups:
  271. - external_security_group
  272. depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, external_machines_security_group ]
  273. # depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router, external_machines_security_group ]
  274.  
  275. my_vol_2:
  276. type: OS::Cinder::Volume
  277. properties:
  278. # size: 25
  279. size: 1
  280. vol_att_2:
  281. type: OS::Cinder::VolumeAttachment
  282. properties:
  283. instance_uuid: { get_resource: front_server_2 }
  284. volume_id: { get_resource: my_vol_2 }
  285. # mountpoint: /dev/vdb
  286. depends_on: [ front_server_2, my_vol_2 ]
  287.  
  288. front_server_3:
  289. type: OS::Nova::Server
  290. properties:
  291. name: Front-Server-3
  292. availability_zone: { get_param: selected_zone }
  293. image: { get_param: front_server_image }
  294. flavor: m1.tiny
  295. # key_name: { get_resource: key_pair }
  296. key_name: { get_param: permanent_key_name }
  297. # networks: [{network: {get_param: private_front_net_name} }]
  298. networks: [{network: {get_resource: private_front_net} }]
  299. security_groups:
  300. - external_security_group
  301. depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, external_machines_security_group ]
  302. # depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router, external_machines_security_group ]
  303.  
  304. my_vol_3:
  305. type: OS::Cinder::Volume
  306. properties:
  307. # size: 25
  308. size: 1
  309. vol_att_3:
  310. type: OS::Cinder::VolumeAttachment
  311. properties:
  312. instance_uuid: { get_resource: front_server_3 }
  313. volume_id: { get_resource: my_vol_3 }
  314. # mountpoint: /dev/vdb
  315. depends_on: [ front_server_2, my_vol_3 ]
  316.  
  317. control_server:
  318. type: OS::Nova::Server
  319. properties:
  320. name: Bastion-Server
  321. availability_zone: { get_param: selected_zone }
  322. #
  323. # image: { get_param: front_server_image }
  324. #
  325. image: Ubuntu 14.04
  326. flavor: m1.small
  327. # admin_user: 'ubuntu'
  328. # admin_pass: 'abc'
  329. # key_name: { get_resource: key_pair }
  330. key_name: { get_param: permanent_key_name }
  331. # networks: [{network: {get_param: private_front_net_name} }]
  332. networks: [{network: {get_resource: private_front_net} }]
  333. security_groups:
  334. - external_security_group
  335. user_data_format: RAW
  336. # user_data_format: HEAT_CFNTOOLS
  337. # user_data_format: SOFTWARE_CONFIG
  338. # user_data_format DEFAULT option = HEAT_CFNTOOLS
  339. user_data:
  340. #!/bin/bash
  341. route add -net 192.168.5.0/24 gw 192.168.1.254
  342. # sudo route add -net 192.168.5.0 netmask 255.255.255.0 gw 192.168.1.254
  343. # EOF
  344. # str_replace:
  345. # template: |
  346. # #!/bin/bash -v
  347. # sudo route add -net route_destination gw route_nexthop
  348. # params:
  349. # route_destination: { get_attr: [private_back_subnet, cidr] }
  350. # route_nexthop: { get_attr: [private_port_for_back_router_in_front_net, fixed_ips] }
  351. depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, external_machines_security_group ]
  352. # depends_on: [ key_pair, private_port_for_back_router_in_front_net, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router, external_machines_security_group ]
  353.  
  354. control_server_public_port:
  355. type: OS::Neutron::FloatingIPAssociation
  356. properties:
  357. floatingip_id: {get_resource: floating_IP_1}
  358. port_id: {get_attr: [ control_server, addresses, {get_attr: [private_front_net, name]}, 0, port ]}
  359. depends_on: [ floating_IP_1, control_server, private_front_net, private_front_subnet, front_router, front_router_interface ]
  360. # depends_on: [ floating_IP_1, control_server, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router ]
  361.  
  362. my_vol_4:
  363. type: OS::Cinder::Volume
  364. properties:
  365. # size: 50
  366. size: 2
  367. vol_att_4:
  368. type: OS::Cinder::VolumeAttachment
  369. properties:
  370. instance_uuid: { get_resource: control_server }
  371. volume_id: { get_resource: my_vol_4 }
  372. # mountpoint: /dev/vdb
  373. depends_on: [ control_server, my_vol_4 ]
  374.  
  375.  
  376. # FORTH STEP
  377.  
  378. # FRONT OFFICE LOAD BALANCER - it create a HTTP traffic load balancer for the 2 front-servers created in Front Office LAN with an assoc. public (floating) IP address (the control server is not included in the load balancer)
  379.  
  380. front_lb_health_monitor:
  381. type: OS::Neutron::HealthMonitor
  382. properties:
  383. delay: 90
  384. max_retries: 10
  385. timeout: 5
  386. type: PING
  387.  
  388. front_lb_pool:
  389. type: OS::Neutron::Pool
  390. properties:
  391. description: Balancing Pool of Front Load Balancer
  392. lb_method: ROUND_ROBIN
  393. monitors: [ {get_resource: front_lb_health_monitor} ]
  394. name: FrontLoadBalancer
  395. protocol: HTTP
  396. # subnet: { get_attr: [ private_front_subnet, name ] }
  397. subnet_id: { get_resource: private_front_subnet }
  398. vip:
  399. address: 192.168.1.100
  400. connection_limit: 10000
  401. description: private IP of the load balancer pool
  402. name: front-LB-private-IP
  403. protocol_port: 80
  404. # no session persitence for easy test and demo of balancing)
  405. # session_persistence:
  406. # type: SOURCE_IP
  407. depends_on: [ front_lb_health_monitor, private_front_net, private_front_subnet, front_router, front_router_interface, front_server_1, front_server_2, front_server_3 ]
  408.  
  409. front_load_balancer:
  410. type: OS::Neutron::LoadBalancer
  411. properties:
  412. members: [ { get_resource: front_server_1 }, { get_resource: front_server_2 }, { get_resource: front_server_3 } ]
  413. pool_id: { get_resource: front_lb_pool }
  414. protocol_port: 80
  415. depends_on: [ front_lb_pool, front_server_1, front_server_2, front_server_3 ]
  416.  
  417. front_load_balancer_public_port:
  418. type: OS::Neutron::FloatingIPAssociation
  419. properties:
  420. floatingip_id: {get_resource: floating_IP_2}
  421. port_id: { get_attr: [ front_lb_pool, vip, port_id ] }
  422. depends_on: [ floating_IP_2, front_load_balancer, front_lb_pool, private_front_net, private_front_subnet, front_router, front_router_interface ]
  423.  
  424.  
  425.  
  426. #
  427. # Now it creates the backoffice network
  428. #
  429.  
  430.  
  431. # Back-Office network and a router to connect it with the Front-Office network
  432.  
  433. private_back_net:
  434. type: OS::Neutron::Net
  435. properties:
  436. name: { list_join: [ '-', ['Red', 'Trasera', {get_param: "OS::stack_name"}] ] }
  437. # dependencies are added to grant this network is not created before aany floating (public) IP has been associated in the front-office in order to solve Neutron BUG
  438. depends_on: [ control_server_public_port, front_load_balancer_public_port ]
  439.  
  440. private_back_subnet:
  441. type: OS::Neutron::Subnet
  442. properties:
  443. network: { get_resource: private_back_net }
  444. cidr: 192.168.5.0/24
  445. gateway_ip: 192.168.5.1
  446. # allocation_pools:
  447. # - start: 192.168.5.1
  448. # end: 192.168.5.254
  449. dns_nameservers: [ {get_param: DNS_server} ]
  450. enable_dhcp: True
  451. ip_version: 4
  452. name:
  453. str_replace:
  454. template: Sub-$BackNetName
  455. params:
  456. $BackNetName: { get_attr: [private_back_net, name] }
  457. depends_on: [ private_back_net ]
  458.  
  459. private_port_for_back_router_in_front_net:
  460. type: OS::Neutron::Port
  461. properties:
  462. # network: { get_param: private_front_net_name }
  463. network: { get_resource: private_front_net }
  464. fixed_ips:
  465. - ip_address: 192.168.1.254
  466. name: Puerto-frontal-en-Router-Trasero
  467. depends_on: private_front_subnet
  468.  
  469. back_router:
  470. type: OS::Neutron::Router
  471. properties:
  472. name: Router-Trasero
  473. depends_on: [ private_front_subnet, private_back_subnet ]
  474.  
  475. back_router_interface_1:
  476. type: OS::Neutron::RouterInterface
  477. properties:
  478. router_id: { get_resource: back_router }
  479. # router: { get_attr: [back_router, name] }
  480. # subnet: { get_attr: [private_back_subnet, name] }
  481. subnet_id: { get_resource: private_back_subnet }
  482. depends_on: [back_router, private_back_subnet]
  483.  
  484. back_router_interface_2:
  485. type: OS::Neutron::RouterInterface
  486. properties:
  487. router_id: { get_resource: back_router }
  488. # router: { get_attr: [back_router, name] }
  489. # port: { get_attr: [private_port_for_back_router_in_front_net, name] }
  490. port_id: { get_resource: private_port_for_back_router_in_front_net }
  491. depends_on: [back_router, private_port_for_back_router_in_front_net]
  492.  
  493.  
  494.  
  495.  
  496.  
  497. # Security Groups for the bacj-office network:
  498.  
  499.  
  500.  
  501. # b) security group for the devices hat are NOT directly accesibe from Internet ("internal security group"), but they are from other internal devices :
  502. internal_machines_security_group:
  503. type: OS::Neutron::SecurityGroup
  504. properties:
  505. description: 'device in this group are only accesible from other of this group or from the external security group'
  506. name: internal_security_group
  507. rules:
  508. # ingoing is allowed for "pinging" (and ANY ICMP protocol) FROM ALL in this "internal security group" for ping TO ANY device in this "internal security group"
  509. - direction: 'ingress'
  510. ethertype: 'IPv4'
  511. protocol: 'icmp'
  512. remote_mode: remote_group_id
  513. # ingoing is allowed for "pinging" (and ANY ICMP protocol) FROM the "external security group" TO ANY device in the "internal security group"
  514. - direction: 'ingress'
  515. ethertype: 'IPv4'
  516. protocol: 'icmp'
  517. remote_mode: remote_group_id
  518. remote_group_id: { get_resource: external_machines_security_group }
  519. # ingoing is allowed for ssh FROM "external security group" TO ANY device in the "internal security group"
  520. - direction: 'ingress'
  521. ethertype: 'IPv4'
  522. protocol: 'tcp'
  523. port_range_max: '22'
  524. port_range_min: '22'
  525. remote_mode: remote_group_id
  526. remote_group_id: { get_resource: external_machines_security_group }
  527. # ougoing is allowed for ANY protocol FROM this group ("internal security group") TO ANY device in the same group ("internal security group")
  528. - direction: 'egress'
  529. ethertype: 'IPv4'
  530. remote_mode: remote_group_id
  531. # ougoing is allowed for ANY protocol FROM this group ("internal security group") TO ANY device in the "external security group"
  532. - direction: 'egress'
  533. ethertype: 'IPv4'
  534. remote_mode: remote_group_id
  535. remote_group_id: { get_resource: external_machines_security_group }
  536.  
  537.  
  538.  
  539. # FITH STEP: Creation of the Servers for the Back-Office
  540.  
  541. back_server_1:
  542. type: OS::Nova::Server
  543. properties:
  544. name: Back-Server-1
  545. availability_zone: { get_param: selected_zone }
  546. image: { get_param: back_server_image }
  547. flavor: m1.medium
  548. # key_name: { get_resource: key_pair }
  549. key_name: { get_param: permanent_key_name }
  550. networks:
  551. # - network: {get_param: private_back_net_name}
  552. - network: {get_resource: private_back_net}
  553. security_groups:
  554. - internal_security_group
  555. # depends_on: [ key_pair, private_back_subnet ]
  556. depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router, internal_machines_security_group ]
  557.  
  558. my_vol_5:
  559. type: OS::Cinder::Volume
  560. properties:
  561. # size: 100
  562. size: 3
  563. vol_att_5:
  564. type: OS::Cinder::VolumeAttachment
  565. properties:
  566. instance_uuid: { get_resource: back_server_1 }
  567. volume_id: { get_resource: my_vol_5 }
  568. # mountpoint: /dev/vdb
  569. depends_on: [ back_server_1, my_vol_5 ]
  570.  
  571. back_server_2:
  572. type: OS::Nova::Server
  573. properties:
  574. name: Back-Server-2
  575. availability_zone: { get_param: selected_zone }
  576. image: { get_param: back_server_image }
  577. flavor: m1.small
  578. # key_name: { get_resource: key_pair }
  579. key_name: { get_param: permanent_key_name }
  580. networks:
  581. # - network: {get_param: private_back_net_name}
  582. - network: {get_resource: private_back_net}
  583. security_groups:
  584. - internal_security_group
  585. # depends_on: [ key_pair, private_back_subnet ]
  586. depends_on: [ key_pair, private_front_net, private_front_subnet, front_router, front_router_interface, private_back_subnet, private_back_net, back_router_interface_1, back_router_interface_2, back_router, internal_machines_security_group ]
  587.  
  588. my_vol_6:
  589. type: OS::Cinder::Volume
  590. properties:
  591. # size: 50
  592. size: 2
  593. vol_att_6:
  594. type: OS::Cinder::VolumeAttachment
  595. properties:
  596. instance_uuid: { get_resource: back_server_2 }
  597. volume_id: { get_resource: my_vol_6 }
  598. # mountpoint: /dev/vdb
  599. depends_on: [ back_server_1, my_vol_6 ]
  600.  
  601.  
  602. # EIGHTH STEP
  603.  
  604. firewall-r1:
  605. type: OS::Neutron::FirewallRule
  606. properties:
  607. action: 'allow'
  608. description: allow ALL ICMP traffic to FrontOffice network
  609. destination_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  610. enabled: True
  611. ip_version: '4'
  612. name: FO-IP-traffic
  613. protocol: 'icmp'
  614. shared: False
  615. source_ip_address: '0.0.0.0/0'
  616. depends_on: [ private_front_subnet ]
  617.  
  618. firewall-r2:
  619. type: OS::Neutron::FirewallRule
  620. properties:
  621. action: 'allow'
  622. description: allow HHTP traffic to FrontOffice network
  623. destination_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  624. destination_port: '80'
  625. enabled: True
  626. ip_version: '4'
  627. name: FO-HTTP-traffic
  628. protocol: 'tcp'
  629. shared: False
  630. source_ip_address: '0.0.0.0/0'
  631. depends_on: [ private_front_subnet ]
  632.  
  633. firewall-r1-bis:
  634. type: OS::Neutron::FirewallRule
  635. properties:
  636. action: 'allow'
  637. description: allow ALL ICMP traffic to FrontOffice network
  638. destination_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  639. enabled: True
  640. ip_version: '4'
  641. name: FO-IP-traffic
  642. protocol: 'icmp'
  643. shared: False
  644. source_ip_address: '0.0.0.0/0'
  645. depends_on: [ private_front_subnet ]
  646.  
  647. firewall-r2-bis:
  648. type: OS::Neutron::FirewallRule
  649. properties:
  650. action: 'allow'
  651. description: allow HHTP traffic to FrontOffice network
  652. destination_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  653. destination_port: '80'
  654. enabled: True
  655. ip_version: '4'
  656. name: FO-HTTP-traffic
  657. protocol: 'tcp'
  658. shared: False
  659. source_ip_address: '0.0.0.0/0'
  660. depends_on: [ private_front_subnet ]
  661.  
  662. firewall-r3:
  663. type: OS::Neutron::FirewallRule
  664. properties:
  665. action: 'allow'
  666. description: allow ssh traffic to Control server
  667. destination_ip_address: { get_attr: [ floating_IP_1, floating_ip_address ] }
  668. destination_port: '22'
  669. enabled: True
  670. ip_version: '4'
  671. name: FO-SSH-traffic
  672. protocol: 'tcp'
  673. shared: False
  674. source_ip_address: '0.0.0.0/0'
  675. depends_on: [ private_front_subnet, control_server_public_port ]
  676.  
  677. firewall-r4:
  678. type: OS::Neutron::FirewallRule
  679. properties:
  680. action: 'allow'
  681. description: allow ALL traffic from FontOffice to BackOffice
  682. destination_ip_address: { get_attr: [ private_back_subnet, cidr ] }
  683. enabled: True
  684. ip_version: '4'
  685. name: FO-BO-traffic
  686. shared: False
  687. source_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  688. depends_on: [ private_front_subnet, private_back_subnet, firewall-r1, firewall-r2, firewall-r3 ]
  689.  
  690. firewall-r4-bis:
  691. type: OS::Neutron::FirewallRule
  692. properties:
  693. action: 'allow'
  694. description: allow ALL traffic from FontOffice to BackOffice
  695. destination_ip_address: { get_attr: [ private_back_subnet, cidr ] }
  696. enabled: True
  697. ip_version: '4'
  698. name: FO-BO-traffic
  699. shared: False
  700. source_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  701. depends_on: [ private_front_subnet, private_back_subnet, firewall-r1, firewall-r2, firewall-r3 ]
  702.  
  703. firewall-r5:
  704. type: OS::Neutron::FirewallRule
  705. properties:
  706. action: 'deny'
  707. description: DENY all the remaining sort of traffic to FrontOffice network, i.e.ALL that it's not previously and explicitily allowed
  708. destination_ip_address: { get_attr: [ private_front_subnet, cidr ] }
  709. enabled: True
  710. ip_version: '4'
  711. name: FO-REMAINING-traffic
  712. shared: False
  713. source_ip_address: '0.0.0.0/0'
  714. depends_on: [ private_front_subnet, firewall-r1, firewall-r2, firewall-r3, firewall-r4 ]
  715. # FWaaS always adds a default "deny all" rule at the lowest precedence of each policy. So the last rule is NOT needed, but added for redundacy reasons
  716. # Note: Consequently, a firewall policy with no rules blocks all traffic by default.
  717.  
  718. firewall-r6:
  719. type: OS::Neutron::FirewallRule
  720. properties:
  721. action: 'allow'
  722. description: allow ALL traffic from ANYONE to ANYONE
  723. destination_ip_address: '0.0.0.0/0'
  724. enabled: True
  725. ip_version: '4'
  726. name: ALL-traffic-allowed
  727. shared: False
  728. source_ip_address: '0.0.0.0/0'
  729. depends_on: [ private_front_subnet, private_back_subnet ]
  730.  
  731.  
  732. firewall-policy-SECURE:
  733. type: OS::Neutron::FirewallPolicy
  734. properties:
  735. audited: False
  736. description: Rules for FrontOffice access traffic
  737. # firewall_rules: [ {get_resource: firewall-r1}, {get_resource: firewall-r2}, {get_resource: firewall-r4}, {get_resource: firewall-r5} ]
  738. firewall_rules: [ {get_resource: firewall-r1}, {get_resource: firewall-r2}, {get_resource: firewall-r4} ]
  739. name: SECURE-Policy
  740. shared: False
  741. depends_on: [ firewall-r6 ]
  742.  
  743. firewall-policy-BASTION-OPEN:
  744. type: OS::Neutron::FirewallPolicy
  745. properties:
  746. audited: False
  747. description: Rules for FrontOffice access traffic
  748. # firewall_rules: [ {get_resource: firewall-r1}, {get_resource: firewall-r2}, {get_resource: firewall-r3}, {get_resource: firewall-r4}, {get_resource: firewall-r5} ]
  749. firewall_rules: [ {get_resource: firewall-r1-bis}, {get_resource: firewall-r2-bis}, {get_resource: firewall-r3}, {get_resource: firewall-r4-bis} ]
  750. name: BASTION-OPEN-Policy
  751. shared: False
  752. # depends_on: [ firewall-r1-bis, firewall-r2-bis, firewall-r3, firewall-r4, firewall-r5 ]
  753. depends_on: [ firewall-r1-bis, firewall-r2-bis, firewall-r3, firewall-r4-bis ]
  754.  
  755. firewall-policy-ALL-ALLOWED:
  756. type: OS::Neutron::FirewallPolicy
  757. properties:
  758. audited: False
  759. description: Rules for FrontOffice access traffic
  760. firewall_rules: [ {get_resource: firewall-r6}]
  761. name: ALL-ALLOWED-Policy
  762. shared: False
  763. depends_on: [ firewall-r6 ]
  764.  
  765. firewall-cerberus:
  766. type: OS::Neutron::Firewall
  767. properties:
  768. admin_state_up: True
  769. description: firewall for this project
  770. # firewall_policy_id: { get_resource: firewall-policy-BASTION-OPEN }
  771. firewall_policy_id: { get_resource: firewall-policy-ALL-ALLOWED }
  772. name: cerberus
  773. # depends_on: [ firewall-policy-BASTION-OPEN ]
  774. depends_on: [ firewall-policy-ALL-ALLOWED ]
  775.  
  776.  
  777.  
  778.  
  779. # LAST STEP: shows the needed outputs (and some one else, not needed)
  780. outputs:
  781.  
  782. front_load_balancer_public_IP_adress:
  783. description: public IP Address of the front Load Balancer Group (VIP), get from the associated port
  784. value: { get_attr: [ floating_IP_2, floating_ip_address ] }
  785.  
  786. control_server_public_port_ip:
  787. description: Public (floating) IP address of the Control Server
  788. value: { get_attr: [ floating_IP_1, floating_ip_address ] }
  789.  
  790. generated_private_key_pair:
  791. description: private part of generated key pair.
  792. value: { get_attr: [ key_pair, private_key ] }
  793.  
  794. Stack_name:
  795. description: Stack_name.
  796. value: { get_param: "OS::stack_name" }
  797.  
  798. back_office_LAN_cidr:
  799. description: CIDR de la red back office.
  800. value: { get_attr: [private_back_subnet, cidr] }
  801.  
  802. back_office_route_IP_in_front_office_LAN-1:
  803. description: IP del "back-router" en su puerto en la front office.
  804. value: { get_attr: [private_port_for_back_router_in_front_net, fixed_ips] }
  805.  
  806. back_office_route_IP_in_front_office_LAN-2:
  807. description: IP del "back-router" en su puerto en la front office.
  808. value: { get_attr: [private_port_for_back_router_in_front_net, fixed_ips, 0, ip_address] }
  809.  
  810. # control_server_consoles:
  811. # description: url of Control Server CONSOLEs.
  812. # value: { get_attr: [control_server, console_urls] }
  813.  
  814. # control_server_console_1:
  815. # description: url of Control Server CONSOLE - type Nova.
  816. # value: { get_attr: [control_server, console_urls, novnc] }
  817.  
  818. # control_server_console_2:
  819. # description: url of Control Server CONSOLE - type xvpvnc
  820. # value: { get_attr: [control_server, console_urls, xvpvnc] }
  821.  
  822. # control_server_console_3:
  823. # description: url of Control Server CONSOLE - type spice-html5
  824. # value: { get_attr: [control_server, console_urls, spice-html5] }
  825.  
  826. # control_server_console_4:
  827. # description: url of Control Server CONSOLE - type rdp-html5
  828. # value: { get_attr: [control_server, console_urls, rdp-html5] }
  829.  
  830. # control_server_console_5:
  831. # description: url of Control Server CONSOLE - type serial
  832. # value: { get_attr: [control_server, console_urls, serial] }
  833.  
  834. # private_front_net_name:
  835. # description: private_front_net_name.
  836. # value: {get_attr: [private_front_net, name]}
  837.  
  838. # port_control_server:
  839. # description: port ID of Control Server.
  840. # value: {get_attr: [ control_server, addresses, {get_attr: [private_front_net, name]}, 0, port ]}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!