heat_template_version: rocky

description: >
  OpenStack containerized Neutron L3 agent

parameters:
  ContainerNeutronL3AgentImage:
    description: image
    type: string
  ContainerNeutronConfigImage:
    description: The container image to use for the neutron config_volume
    type: string
  DockerNeutronL3AgentUlimit:
    default: ['nofile=16384']
    description: ulimit for Neutron L3 Agent Container
    type: comma_delimited_list
  DockerAdditionalSockets:
    default: ['/var/lib/openstack/docker.sock']
    description: Additional domain sockets for the docker daemon to bind to (useful for mounting
                 into containers that launch other containers)
    type: comma_delimited_list
  NeutronL3AgentLoggingSource:
    type: json
    default:
      tag: openstack.neutron.agent.l3
      file: /var/log/containers/neutron/l3-agent.log
  NeutronEnableKeepalivedWrapper:
    description: Generate a wrapper script so neutron launches keepalived processes in a
                 separate container.
    type: boolean
    default: true
  NeutronEnableHaproxyDockerWrapper:
    description: Generate a wrapper script so neutron launches haproxy in a separate container.
    type: boolean
    default: true
  NeutronEnableDibblerDockerWrapper:
    description: Generate a wrapper script so neutron launches the dibbler client in a separate
                 container.
    type: boolean
    default: true
  NeutronEnableRadvdDockerWrapper:
    description: Generate a wrapper script so neutron launches radvd in a separate container. Note
                 that is currently disabled by default pending availability of a fix to radvd
                 (see https://bugzilla.redhat.com/show_bug.cgi?id=1564391). It will be enabled by default
                 once the fix to radvd is generally available across target distributions.
    type: boolean
    default: false
  Debug:
    type: boolean
    default: false
    description: Set to True to enable debugging on all services.
  NeutronWrapperDebug:
    type: boolean
    default: false
    description: Controls debugging for the wrapper scripts.
  ContainerCli:
    type: string
    default: 'podman'
    description: CLI tool used to manage containers.
    constraints:
      - allowed_values: ['docker', 'podman']
  ServiceData:
    default: {}
    description: Dictionary packing service data
    type: json
  ServiceNetMap:
    default: {}
    description: Mapping of service_name -> network name. Typically set
                 via parameter_defaults in the resource registry.  This
                 mapping overrides those in ServiceNetMapDefaults.
    type: json
  DefaultPasswords:
    default: {}
    type: json
  RoleName:
    default: ''
    description: Role name on which the service is applied
    type: string
  RoleParameters:
    default: {}
    description: Parameters specific to the role
    type: json
  EndpointMap:
    default: {}
    description: Mapping of service endpoint -> protocol. Typically set
                 via parameter_defaults in the resource registry.
    type: json
  NeutronL3AgentMode:
    description: |
      Agent mode for L3 agent. Must be one of legacy or dvr_snat.
    default: 'legacy'
    type: string
    constraints:
      - allowed_values:
        - legacy
        - dvr_snat
        - dvr
    tags:
      - role_specific
  MonitoringSubscriptionNeutronL3:
    default: 'overcloud-neutron-l3-agent'
    type: string
  NeutronL3AgentDebug:
    default: ''
    description: Set to True to enable debugging for Neutron L3 agent.
    type: string
    constraints:
      - allowed_values: [ '', 'true', 'True', 'TRUE', 'false', 'False', 'FALSE']
  # NOTE(bogdando): we allow the L3 agent to have AZ configs defined disregard of
  # the used NeutronMechanismDrivers.
  NeutronL3AgentAvailabilityZone:
    description: Availability zone for Neutron L3 agent. If not set,
                 no AZs will be configured for Neutron network services.
    default: ''
    type: string

  NeutronL3AgentExtensions:
    default: ""
    description: |
        Comma-separated list of extensions enabled for the Neutron L3 agent.
    type: comma_delimited_list

  NeutronL3AgentRadvdUser:
    default: "root"
    description: |
      The username passed to radvd, used to drop root privileges and change
      user ID to username and group ID to the primary group of username. If no
      user specified, the user executing the L3 agent will be passed. If "root"
      specified, because radvd is spawned as root, no "username" parameter
      will be passed
    type: string

conditions:
  keepalived_wrapper_enabled: {equals: [{get_param: NeutronEnableKeepalivedWrapper}, true]}
  haproxy_wrapper_enabled: {equals: [{get_param: NeutronEnableHaproxyDockerWrapper}, true]}
  dibbler_wrapper_enabled: {equals: [{get_param: NeutronEnableDibblerDockerWrapper}, true]}
  radvd_wrapper_enabled: {equals: [{get_param: NeutronEnableRadvdDockerWrapper}, true]}
  docker_enabled: {equals: [{get_param: ContainerCli}, 'docker']}
  service_debug_unset: {equals : [{get_param: NeutronWrapperDebug}, false]}
  az_unset: {equals: [{get_param: NeutronL3AgentAvailabilityZone}, '']}
  l3_agent_extensions_empty: {equals : [{get_param: NeutronL3AgentExtensions}, "''"]}

resources:

  ContainersCommon:
    type: ../containers-common.yaml

  NeutronBase:
    type: ./neutron-base.yaml
    properties:
      EndpointMap: {get_param: EndpointMap}
      ServiceData: {get_param: ServiceData}
      ServiceNetMap: {get_param: ServiceNetMap}
      DefaultPasswords: {get_param: DefaultPasswords}
      RoleName: {get_param: RoleName}
      RoleParameters: {get_param: RoleParameters}

  # Merging role-specific parameters (RoleParameters) with the default parameters.
  # RoleParameters will have the precedence over the default parameters.
  RoleParametersValue:
    type: OS::Heat::Value
    properties:
      type: json
      value:
        map_replace:
          - map_replace:
            - neutron::agents::l3::agent_mode: NeutronL3AgentMode
            - values: {get_param: [RoleParameters]}
          - values:
              NeutronL3AgentMode: {get_param: NeutronL3AgentMode}

  NeutronLogging:
    type: OS::TripleO::Services::Logging::NeutronCommon
    properties:
      NeutronServiceName: l3-agent

outputs:
  role_data:
    description: Role data for Neutron L3 agent
    value:
      service_name: neutron_l3
      firewall_rules:
        '106 neutron_l3 vrrp':
          proto: vrrp
      monitoring_subscription: {get_param: MonitoringSubscriptionNeutronL3}
      config_settings:
        map_merge:
          - get_attr: [NeutronBase, role_data, config_settings]
          - get_attr: [RoleParametersValue, value]
          - get_attr: [NeutronLogging, config_settings]
          - tripleo::profile::base::neutron::l3_agent_wrappers::enable_keepalived_wrapper: {get_param: NeutronEnableKeepalivedWrapper}
            tripleo::profile::base::neutron::l3_agent_wrappers::keepalived_process_wrapper: '/var/lib/neutron/keepalived_wrapper'
            # TODO(beagles): this can be removed after a cleanup of the related puppet-tripleo code.
            tripleo::profile::base::neutron::l3_agent_wrappers::keepalived_state_change_wrapper: '/var/lib/neutron/keepalived_state_change_wrapper'
            tripleo::profile::base::neutron::l3_agent_wrappers::keepalived_image: {get_param: ContainerNeutronL3AgentImage}
            tripleo::profile::base::neutron::l3_agent_wrappers::enable_haproxy_wrapper: {get_param: NeutronEnableHaproxyDockerWrapper}
            tripleo::profile::base::neutron::l3_agent_wrappers::haproxy_process_wrapper: '/var/lib/neutron/l3_haproxy_wrapper'
            tripleo::profile::base::neutron::l3_agent_wrappers::haproxy_image: {get_param: ContainerNeutronL3AgentImage}
            tripleo::profile::base::neutron::l3_agent_wrappers::enable_dibbler_wrapper: {get_param: NeutronEnableDibblerDockerWrapper}
            tripleo::profile::base::neutron::l3_agent_wrappers::dibbler_process_wrapper: '/var/lib/neutron/dibbler_wrapper'
            tripleo::profile::base::neutron::l3_agent_wrappers::dibbler_image: {get_param: ContainerNeutronL3AgentImage}
            tripleo::profile::base::neutron::l3_agent_wrappers::enable_radvd_wrapper: {get_param: NeutronEnableRadvdDockerWrapper}
            tripleo::profile::base::neutron::l3_agent_wrappers::radvd_process_wrapper: '/var/lib/neutron/radvd_wrapper'
            tripleo::profile::base::neutron::l3_agent_wrappers::radvd_image: {get_param: ContainerNeutronL3AgentImage}
            tripleo::profile::base::neutron::l3_agent_wrappers::debug:
              if:
                - service_debug_unset
                - {get_param: Debug }
                - {get_param: NeutronWrapperDebug}
            tripleo::profile::base::neutron::container_cli: {get_param: ContainerCli}
          - neutron::agents::l3::debug:
              if:
              - service_debug_unset
              - {get_param: Debug}
              - {get_param: NeutronL3AgentDebug}
          -
          - if:
            - az_unset
            - {}
            - neutron::agents::l3::availability_zone: {get_param: NeutronL3AgentAvailabilityZone}
            if:
            - l3_agent_extensions_empty
            - {}
            - neutron::agents::l3::extensions: {get_param: NeutronL3AgentExtensions}
          - neutron::agents::l3::radvd_user: {get_param: NeutronL3AgentRadvdUser}
      service_config_settings:
        map_merge:
          - get_attr: [NeutronBase, role_data, service_config_settings]
          - rsyslog:
              tripleo_logging_sources_neutron_l3:
                - {get_param: NeutronL3AgentLoggingSource}
      puppet_config:
        puppet_tags: neutron_config,neutron_l3_agent_config
        config_volume: neutron
        step_config: |
          include tripleo::profile::base::neutron::l3
        config_image: {get_param: ContainerNeutronConfigImage}
      kolla_config:
        /var/lib/kolla/config_files/neutron_l3_agent.json:
          command:
            list_join:
              - ' '
              - - /usr/bin/neutron-l3-agent --config-file /usr/share/neutron/neutron-dist.conf --config-dir /usr/share/neutron/l3_agent --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/l3_agent.ini --config-dir /etc/neutron/conf.d/common --config-dir /etc/neutron/conf.d/neutron-l3-agent
                - get_attr: [NeutronLogging, cmd_extra_args]
          config_files:
            - source: "/var/lib/kolla/config_files/src/*"
              dest: "/"
              merge: true
              preserve_properties: true
          permissions:
            - path: /var/log/neutron
              owner: neutron:neutron
              recurse: true
            - path: /var/lib/neutron
              owner: neutron:neutron
              recurse: true
      container_config_scripts: {get_attr: [ContainersCommon, container_config_scripts]}
      deploy_steps_tasks:
        - when: step|int == 1
          block:
            - name: set conditions
              set_fact:
                keepalived_wrapper_enabled: {get_param: NeutronEnableKeepalivedWrapper}
                haproxy_wrapper_enabled: {get_param: NeutronEnableHaproxyDockerWrapper}
                dibbler_wrapper_enabled: {get_param: NeutronEnableDibblerDockerWrapper}
                radvd_wrapper_enabled: {get_param: NeutronEnableRadvdDockerWrapper}
                debug_enabled:
                  if:
                    - service_debug_unset
                    - {get_param: Debug }
                    - {get_param: NeutronWrapperDebug}
            - name: Create l3 systemd wrappers
              include_role:
                name: tripleo-systemd-wrapper
              vars:
                tripleo_systemd_wrapper_cmd: "{{ l3_wrapper_item.cmd }}"
                tripleo_systemd_wrapper_config_bind_mount: "/var/lib/config-data/puppet-generated/neutron:/etc/neutron:ro"
                tripleo_systemd_wrapper_container_cli: "{{ container_cli }}"
                tripleo_systemd_wrapper_debug: "{{ debug_enabled }}"
                tripleo_systemd_wrapper_docker_additional_sockets: {get_param: DockerAdditionalSockets}
                tripleo_systemd_wrapper_image_name: {get_param: ContainerNeutronL3AgentImage}
                tripleo_systemd_wrapper_service_dir: /var/lib/neutron
                tripleo_systemd_wrapper_service_kill_script: "{{ l3_wrapper_item.kill_script }}"
                tripleo_systemd_wrapper_service_name: "{{ l3_wrapper_item.name }}"
              loop_control:
                loop_var: l3_wrapper_item
              loop:
                - name: l3_keepalived
                  cmd: /usr/sbin/keepalived -n -l -D
                  kill_script: keepalived-kill
                - name: l3_haproxy
                  cmd: >-
                      $(if [ -f /usr/sbin/haproxy-systemd-wrapper ]; then
                      echo "/usr/sbin/haproxy -Ds";
                      else
                      echo "/usr/sbin/haproxy -Ws"; fi)
                  kill_script: haproxy-kill
                - name: l3_dibbler
                  cmd: /usr/sbin/dibbler-client run
                  kill_script: dibbler-kill
                - name: l3_radvd
                  cmd: /usr/sbin/radvd -n
                  kill_script: radvd-kill
      docker_config:
        step_4:
          neutron_l3_agent:
            start_order: 10
            image: {get_param: ContainerNeutronL3AgentImage}
            net: host
            pid: host
            privileged: true
            restart: always
            depends_on:
              - openvswitch
            healthcheck: {get_attr: [ContainersCommon, healthcheck_rpc_port]}
            ulimit: {get_param: DockerNeutronL3AgentUlimit}
            volumes:
              list_concat:
                - {get_attr: [ContainersCommon, volumes]}
                - {get_attr: [NeutronLogging, volumes]}
                -
                  - /var/lib/kolla/config_files/neutron_l3_agent.json:/var/lib/kolla/config_files/config.json:ro
                  - /var/lib/config-data/puppet-generated/neutron/:/var/lib/kolla/config_files/src:ro
                  - /lib/modules:/lib/modules:ro
                  - /run/openvswitch:/run/openvswitch
                  - /var/lib/neutron:/var/lib/neutron:shared,z
                  - /run/netns:/run/netns:shared
                  - /var/lib/neutron/kill_scripts:/etc/neutron/kill_scripts:shared,z
                -
                  if:
                    - docker_enabled
                    - - /var/lib/openstack:/var/lib/openstack
                    - null
                -
                  if:
                    - keepalived_wrapper_enabled
                    - - /var/lib/neutron/l3_keepalived/wrapper:/usr/local/bin/keepalived:ro
                    - null
                -
                  if:
                    - haproxy_wrapper_enabled
                    - - /var/lib/neutron/l3_haproxy/wrapper:/usr/local/bin/haproxy:ro
                    - null
                -
                  if:
                    - radvd_wrapper_enabled
                    - - /var/lib/neutron/l3_radvd/wrapper:/usr/local/bin/radvd:ro
                    - null
                -
                  if:
                    - dibbler_wrapper_enabled
                    - - /var/lib/neutron/l3_dibbler/wrapper:/usr/local/bin/dibbler_client:ro
                    - null
            environment:
              KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
      metadata_settings:
        get_attr: [NeutronBase, role_data, metadata_settings]
      host_prep_tasks:
        list_concat:
          - {get_attr: [NeutronLogging, host_prep_tasks]}
          - - name: create /run/netns with temp namespace
              command: ip netns add ns_temp
              register: ipnetns_add_result
              ignore_errors: True
          - - name: remove temp namespace
              command: ip netns delete ns_temp
              ignore_errors: True
              when: ipnetns_add_result.rc == 0
          - - name: create /var/lib/neutron
              file:
                path: /var/lib/neutron
                state: directory
                setype: svirt_sandbox_file_t
          - - name: enable virt_sandbox_use_netlink for healtcheck
              seboolean:
                name: virt_sandbox_use_netlink
                persistent: yes
                state: yes
      upgrade_tasks: []
      fast_forward_upgrade_tasks:
        - when:
            - step|int == 0
            - release == 'ocata'
          block:
            - name: Check if neutron_l3_agent is deployed
              command: systemctl is-enabled --quiet neutron-l3-agent
              ignore_errors: True
              register: neutron_l3_agent_enabled_result
            - name: Set fact neutron_l3_agent_enabled
              set_fact:
                neutron_l3_agent_enabled: "{{ neutron_l3_agent_enabled_result.rc == 0 }}"
        - name: Stop neutron_l3_agent
          service: name=neutron-l3-agent state=stopped enabled=no
          when:
            - step|int == 1
            - release == 'ocata'
            - neutron_l3_agent_enabled|bool
      post_upgrade_tasks:
        - name: Check for neutron user
          getent:
            database: passwd
            key: neutron
          ignore_errors: True
        - name: Set neutron_user_avail
          set_fact:
            neutron_user_avail: "{{ getent_passwd is defined }}"
        - when:
            - step|int == 2
            - neutron_user_avail|bool
          block:
            - name: Ensure r/w access for existing files after upgrade
              become: true
              shell: |
                umask 0002
                setfacl -d -R -m u:neutron:rwx /var/lib/neutron
                setfacl -R -m u:neutron:rw /var/lib/neutron
                find /var/lib/neutron -type d -exec setfacl -m u:neutron:rwx '{}' \;
            - name: Provide access to domain sockets
              become: true
              shell: |
                umask 0002
                setfacl -m u:neutron:rwx "{{ item }}"
              with_items:
                - /var/lib/neutron/metadata_proxy
                - /var/lib/neutron/keepalived-state-change
                - /var/lib/neutron
              # These files are not necessarily present
              ignore_errors: True
