roles

Choose from the following roles to be configured on this node.

Default: ['broker','node','msgserver','datastore','nameserver']

install_method

Choose from the following ways to provide packages:

Default: yum

parallel_deployment

This flag is used to control some module behaviors when an outside utility (like oo-install) is managing the deployment of OpenShift across multiple hosts simultaneously. Some configuration tasks can"t be performed during a multi-host parallel installation and this boolean enables the user to indicate whether or not thos tasks should be attempted.

Default: false

repos_base

Base path to repository for OpenShift Origin

Default: Nightlies

architecture

CPU Architecture to use for the definition OpenShift Origin yum repositories

Default: $::architecture fact

override_install_repo

Repository path override. Uses dependencies from repos_base but uses override_install_repo path for OpenShift RPMs. Used when doing local builds.

Default: none

os_repo

The URL for a RHEL/Centos 6 yum repository used with the "yum" install method. Should end in x86_64/os/.

Default: no change

os_updates_repo

The URL for a RHEL/Centos 6 yum updates repository used with the "yum" install method. Should end in x86_64/.

Default: no change

jboss_repo_base

The URL for a JBoss repositories used with the "yum" install method. Does not install repository if not specified.

jenkins_repo_base

The URL for a Jenkins repositories used with the "yum" install method. Does not install repository if not specified.

optional_repo

The URL for a EPEL or optional repositories used with the "yum" install method. Does not install repository if not specified.

domain

Default: example.com The network domain under which apps and hosts will be placed.

broker_hostname

node_hostname

nameserver_hostname

msgserver_hostname

datastore_hostname

Default: the root plus the domain, e.g. broker.example.com - except nameserver=ns1.example.com

These supply the FQDN of the hosts containing these components. Used for configuring the host’s name at install, and also for configuring the broker application to reach the services needed.

datastore1_ip_addr|datastore2_ip_addr|datastore3_ip_addr

Default: undef

IP addresses of the first 3 MongoDB servers in a replica set. Add datastoreX_ip_addr parameters for larger clusters.

nameserver_ip_addr

IP of a nameserver instance or current IP if installing on this node. This is used by every node to configure its primary name server.

Default: the current IP (at install)

bind_key

When the nameserver is remote, use this to specify the key for updates. This is the "Key:" field from the .private key file generated by dnssec-keygen. This field is required on all nodes.

bind_key_algorithm

When using a BIND key, use this algorithm for the BIND key.

Default: HMAC-MD5

bind_krb_keytab

When the nameserver is remote, Kerberos keytab together with principal can be used instead of the dnssec key for updates.

bind_krb_principal

When the nameserver is remote, this Kerberos principal together with Kerberos keytab can be used instead of the dnssec key for updates.

Example: 'DNS/broker.example.com@EXAMPLE.COM'

aws_access_key_id

This and the next value are Amazon AWS security credentials. The aws_access_key_id is a string which identifies an access credential.

aws_secret_key

This is the secret portion of AWS Access Credentials indicated by the aws_access_key_id

aws_zone_id

This is the ID string for an AWS Hosted zone which will contain the OpenShift application records.

conf_nameserver_upstream_dns

List of upstream DNS servers to use when installing a nameserver on this node.

Default: ['8.8.8.8']

broker_ip_addr

This is used for the node to record its broker. Also is the default for the nameserver IP if none is given.

Default: the current IP (at install)

broker_cluster_members

An array of broker hostnames that will be load-balanced for high-availability.

Default: undef

broker_cluster_ip_addresses

An array of Broker IP addresses within the load-balanced cluster.

Default: undef

broker_virtual_ip_address

The virtual IP address that will front-end the Broker cluster.

Default: undef

broker_virtual_hostname

The hostame that represents the Broker API cluster. This name is associated to broker_virtual_ip_address and added to Named for DNS resolution.

Default: "broker.${domain}"

load_balancer_master

Sets the state of the load-balancer. Valid options are true or false. true sets the load-balancer as the active listener for the Broker cluster Virtual IP address. Only 1 load_balancer_master is allowed within a Broker cluster.

Default: false

load_balancer_auth_password

The password used to secure communication between the load-balancers within a Broker cluster.

Default: 'changeme'

node_ip_addr

This is used for the node to give a public IP, if different from the one on its NIC.

Default: the current IP (at install)

Node Resource Limits

configure_ntp

Enabling this configures NTP. It is important that the time be synchronized across hosts because MCollective messages have a TTL of 60 seconds and may be dropped if the clocks are too far out of synch. However, NTP is not necessary if the clock will be kept in synch by some other means.

Default: true

ntp_servers

If configure_ntp is set to true (default), ntp_servers allows users to specify an array of NTP servers used for clock synchronization.

Default: ['time.apple.com iburst', 'pool.ntp.org iburst', 'clock.redhat.com iburst']

msgserver_cluster

Set to true to cluster ActiveMQ for high-availability and scalability of OpenShift message queues.

Default: false

msgserver_cluster_members

An array of ActiveMQ server hostnames. Required when parameter msgserver_cluster is set to true.

Default: undef

mcollective_cluster_members

DEPRECATED: use msgserver_cluster_members instead, if both are set they must match

Default: $msgserver_cluster_members

msgserver_password

Password used by ActiveMQ’s amquser. The amquser is used to authenticate ActiveMQ inter-cluster communication. Only used when msgserver_cluster is true.

Default "changeme"

msgserver_admin_password

This is the admin password for the ActiveMQ admin console, which is not needed by OpenShift but might be useful in troubleshooting.

Default: scrambled

msgserver_tls_enabled

This configures mcollective and activemq to use end-to-end encryption over TLS. Use enabled to support both TLS and non-TLS, or strict to only support TLS.

Default: 'disabled'

msgserver_tls_keystore_password

The password used to protect the keystore. It must be greater than 6 characters. This is required.

Default: password

msgserver_tls_ca

Location for certificate ca

Default: /var/lib/puppet/ssl/certs/ca.pem

msgserver_tls_cert

Location for certificate cert

Default: /var/lib/puppet/ssl/certs/${lower_fqdn}.pem

msgserver_tls_key

Location for certificate key

Default: /var/lib/puppet/ssl/private_keys/${lower_fqdn}.pem

mcollective_user

mcollective_password

This is the user and password shared between broker and node for communicating over the mcollective topic channels in ActiveMQ. Must be the same on all broker and node hosts.

Default: mcollective/marionette

mongodb_admin_user

mongodb_admin_password

These are the username and password of the administrative user that will be created in the MongoDB datastore. These credentials are not used by in this script or by OpenShift, but an administrative user must be added to MongoDB in order for it to enforce authentication.

Default: admin/mongopass

mongodb_broker_user

mongodb_broker_password

These are the username and password of the normal user that will be created for the broker to connect to the MongoDB datastore. The broker application’s MongoDB plugin is also configured with these values.

Default: openshift/mongopass

mongodb_name

This is the name of the database in MongoDB in which the broker will store data.

Default: openshift_broker

mongodb_port

The TCP port used for MongoDB to listen on.

Default: '27017'

mongodb_replicasets

Enable/disable MongoDB replica sets for database high-availability.

Default: false

mongodb_replica_name

The MongoDB replica set name when $mongodb_replicasets is true.

Default: 'openshift'

mongodb_replica_primary

Set the host as the primary with true or secondary with false. Must be set on one and only one host within the mongodb_replicasets_members array.

Default: undef

mongodb_replica_primary_ip_addr

The IP address of the Primary host within the MongoDB replica set.

Default: undef

mongodb_replicasets_members

An array of [host:port] of replica set hosts. Example: ['10.10.10.10:27017', '10.10.10.11:27017', '10.10.10.12:27017']

Default: undef

mongodb_keyfile

The file containing the $mongodb_key used to authenticate MongoDB replica set members.

Default: '/etc/mongodb.keyfile'

mongodb_key

The key used by members of a MongoDB replica set to authenticate one another.

Default: 'changeme'

openshift_user1

openshift_password1

This user and password are entered in the /etc/openshift/htpasswd file as a demo/test user. You will likely want to remove it after installation (or just use a different auth method).

Default: demo/changeme

conf_broker_auth_salt

conf_broker_auth_private_key

Salt and private keys used when generating secure authentication tokens for Application to Broker communication. Requests like scale up/down and jenkins builds use these authentication tokens. This value must be the same on all broker nodes.

Default: Self signed keys are generated. Will not work with multi-broker setup.

conf_broker_default_templates

Customize default app templates for specified framework cartridges. Space-separated list of elements <cartridge-name>|<git url> - URLs must be available for all nodes. URL will be cloned as the git repository for the cartridge at app creation unless the user specifies their own. e.g.: DEFAULT_APP_TEMPLATES=php-5.3|http://example.com/php.git perl-5.10|file:///etc/openshift/cart.conf.d/templates/perl.git WARNING: do not include private credentials in any URL; they would be visible in every app’s cloned repository.

Default: ''

conf_broker_valid_gear_cartridges

Enumerate the set of valid gear sizes for a given cartridge. If not specified, its assumed the cartridge can run on any defined gear size. Space-separated list of elements <cartridge-name>|<size1,size2> e.g.: VALID_GEAR_SIZES_FOR_CARTRIDGE="php-5.3|medium,large jbossews-2.0|large"

Default: ''

conf_console_logout_link

The URL to use for logging a user out of the console When set to nothing, no logout link is displayed Default: ''

conf_console_product_logo

Relative path to product logo URL

Default: if ose_version == undef '/assets/logo-origin.svg' if ose_version != undef '/assets/logo-enterprise-horizontal.svg'

conf_console_product_title

OpenShift Instance Name

Default: if ose_version == undef 'OpenShift Origin' if ose_version != undef 'Openshift Enterprise'

conf_broker_multi_haproxy_per_node

This setting is applied on a per-scalable-application basis. When set to true, OpenShift will allow multiple instances of the HAProxy gear for a given scalable app to be established on the same node. Otherwise, on a per-scalable-application basis, a maximum of one HAProxy gear can be created for every node in the deployment (this is the default behavior, which protects scalable apps from single points of failure at the Node level).

Default: false

conf_broker_session_secret

conf_console_session_secret

Session secrets used to encode cookies used by console and broker. This value must be the same on all broker nodes.

Default: undef

conf_ha_dns_prefix

conf_ha_dns_suffix

Default prefix: 'ha-' Default suffix: ''

conf_valid_gear_sizes

List of all gear sizes this will be used in this OpenShift installation.

Default: ['small']

conf_default_gear_size

Default gear size if one is not specified.

Default: 'small'

conf_default_gear_capabilities

List of all gear sizes that newly created users will be able to create.

Default: ['small']

conf_default_max_domains

Default max number of domains a user is allowed to use

Default: 10

conf_default_max_gears

Default max number of gears a user is allowed to use

Default: 100

conf_broker_default_region_name

Default region if one is not specified.

Default: ""

conf_broker_allow_region_selection

Should the user be allowed to select the region the application is placed in.

Default: true

conf_broker_use_predictable_gear_uuids

When true, new gear UUIDs (and thus gear usernames) are created with the format: <domain_namespace>­<app_name>­<gear_index>

Default: false

conf_broker_require_districts

When true, gear placement will fail if there are no available districts with the correct gear profile.

Default: true

conf_broker_require_zones

When true, gear placement will fail if there are no available zones with the correct gear profile.

Default: false

conf_broker_zone_min_gear_group

desired minimum number of zones between which gears in application gear groups are distributed.

Default: 1

broker_external_access_admin_console

When true, enable access to the administration console. Authentication for the Administration Console is only handled via the ldap Broker Auth Plugin, using <code>broker_ldap_admin_console_uri</code>

Default: false

broker_dns_plugin

DNS plugin used by the broker to register application DNS entries. Options:

Default: 'nsupdate'

broker_auth_plugin

Authentication setup for users of the OpenShift service. Options:

Default: htpasswd

broker_krb_service_name

The KrbServiceName value for mod_auth_kerb configuration. This value will be prefixed with 'HTTP/' to create the krb5 service principal.

Default: hostname

broker_krb_auth_realms

The KrbAuthRealms value for mod_auth_kerb configuration

broker_krb_keytab

The Krb5KeyTab value of mod_auth_kerb is not configurable — the keytab is expected in /var/www/openshift/broker/httpd/conf.d/http.keytab

broker_ldap_uri

URI to the LDAP server (e.g. ldap://ldap.example.com:389/ou=People,dc=my-domain,dc=com?uid?sub?(objectClass=*)). Set <code>broker_auth_plugin</code> to <code>ldap</code> to enable this feature.

broker_ldap_bind_dn

LDAP DN (Distinguished name) of user to bind to the directory with. (e.g. cn=administrator,cn=Users,dc=domain,dc=com) Default is anonymous bind.

broker_ldap_bind_password

Password of bind user set in broker_ldap_bind_dn. Default is anonymous bind with a blank password.

broker_admin_console_ldap_uri

URI to the LDAP server for admin console access (e.g. ldap://ldap.example.com:389/ou=People,dc=my-domain,dc=com?uid?sub?(objectClass=*)). Set <code>broker_external_access_admin_console</code> to enable this feature

node_shmmax

kernel.shmmax sysctl setting for /etc/sysctl.conf

This setting should work for most deployments but if this is desired to be tuned higher, the general recommendations are as follows:

shmmax = shmall * PAGE_SIZE
- PAGE_SIZE = getconf PAGE_SIZE
- shmall = cat /proc/sys/kernel/shmall

shmmax is not recommended to be a value higher than 80% of total available RAM on the system (expressed in BYTES).

Default: kernel.shmmax = 68719476736

node_shmall

kernel.shmall sysctl setting for /etc/sysctl.conf, this defaults to 2097152 BYTES

This parameter sets the total amount of shared memory pages that can be used system wide. Hence, SHMALL should always be at least ceil(shmmax/PAGE_SIZE).

Default: kernel.shmall = 4294967296

node_container_plugin

Specify the container type to use on the node. * selinux - This is the default OpenShift Origin container type. At this time there are no other supported plugins.

Default: 'selinux'

node_frontend_plugins

Specify one or more plugins to use register HTTP and web-socket connections for applications. Options:

Default: ['apache-vhost','nodejs-websocket']

node_unmanaged_users

List of user names who have UIDs in the range of OpenShift gears but must be excluded from OpenShift gear setups.

Default: []

conf_node_external_eth_dev

External facing network device. Used for routing and traffic control setup.

Default: eth0

conf_node_proxy_ports_per_gear

Number of proxy ports available per gear.

Default: 5

conf_node_public_key

conf_node_private_key

Public and private keys used for gears on the default domain. Both values must be defined or default self signed keys will be generated.

Default: Self signed keys are generated.

conf_node_supplementary_posix_groups

Name of supplementary UNIX group to add a gear to.

conf_node_watchman_service

Enable/Disable the OpenShift Node watchman service

Default: true

conf_node_watchman_gearretries

Number of restarts to attempt before waiting RETRY_PERIOD

Default: 3

conf_node_watchman_retrydelay

Number of seconds to wait before accepting another gear restart

Default: 300

conf_node_watchman_retryperiod

Number of seconds to wait before resetting retries

Default: 28800

conf_node_watchman_statechangedelay

Number of seconds a gear must remain inconsistent with it’s state before Watchman attempts to reset state

Default: 900

conf_node_watchman_statecheckperiod

Wait at least this number of seconds since last check before checking gear state on the Node. Use this to reduce Watchman’s GearStatePlugin’s impact on the system.

Default: 0

conf_node_custom_motd

Define a custom MOTD to be displayed to users who connect to their gears directly. If undef, uses the default MOTD included with the node package.

Default: undef

development_mode

Set development mode and extra logging.

Default: false

register_host_with_nameserver

Setup DNS entries for this host in a locally installed bind DNS instance.

Default: false

dns_infrastructure_zone

The name of a zone to create which will contain OpenShift infrastructure. If this is unset then no infrastructure zone or other artifacts will be created.

Default: ""

dns_infrastructure_key

A dnssec symmetric key which will grant update access to the infrastucture zone resource records.

This is ignored unless dns_infrastructure_zone is set.

Default: ""

dns_infrastructure_key_algorithm

When using a BIND key, use this algorithm for the infrastructure BIND key.

This is ignored unless dns_infrastructure_zone is set.

Default: 'HMAC-MD5'

dns_infrastructure_names

An array of hashes containing hostname and IP Address pairs to populate the infrastructure zone.

This value is ignored unless dns_infrastructure_zone is set.

Hostnames can be simple names or fully qualified domain name (FQDN).

Simple names will be placed in the dns_infrastructure_zone. Matching FQDNs will be placed in the _dns_infrastructure_zone. Hostnames anchored with a dot (.) will be added verbatim.

Default: []

$dns_infrastructure_names = [
  {hostname => "10.0.0.1", ipaddr => "broker1"},
  {hostname => "10.0.0.2", ipaddr => "data1"},
  {hostname => "10.0.0.3", ipaddr => "message1"},
  {hostname => "10.0.0.11", ipaddr => "node1"},
  {hostname => "10.0.0.12", ipaddr => "node2"},
  {hostname => "10.0.0.13", ipaddr => "node3"},
]

manage_firewall

Indicate whether or not this module will configure the firewall for you

Default: false

syslog_enabled

Default: undef

syslog_central_server_hostname

Host name of the central log server where rsyslog logs will be forwarded to.

install_cartridges

List of cartridges to be installed on the node. Options:

Default: ['10gen-mms-agent','cron','diy','haproxy','mongodb', 'nodejs','perl','php','phpmyadmin','postgresql', 'python','ruby','jenkins','jenkins-client','mysql'] OSE Default : ['cron','diy','haproxy','mongodb','nodejs','perl', 'php','postgresql','python','ruby','jenkins', 'jenkins-client','mysql'],

Default in OpenShift Enterprise: ['cron','diy','haproxy','mongodb','nodejs','perl','php', 'postgresql','python','ruby','jenkins','jenkins-client', 'jbossews','mysql'],

update_network_conf_files

Indicate whether or not this module will configure resolv.conf and network for you.

Default: true

ose_version

Set this to the X.Y (ie: 2.2) version of Openshift Enterprise to ensure an Openshift Enterprise supported configuration is used.

See README_OSE.asciidoc distributed with the openshift_origin puppet module for more details.

Default: undef

ose_unsupported

Set this to true in order to allow Openshift Enterprise unsupported configurations. Only appropriate for proof of concept environments.

This parameter is only used when ose_version is set.

Default: false

quickstarts_json

JSON content to be deployed into /etc/openshift/quickstarts.json

Default: undef, which on Origin will deploy the contents of templates/broker/quickstarts.json.erb

OSE Default: undef and will not deploy any quickstarts