mariadb_stack.yaml

heat_template_version: 2013-05-23

description: |
  Deploys Salt-master and serveral salt-minions for a MariaDB/Galera cluster.
  One Minion will be for haproxy
  One Minion will act as a bootstrap node
  Two minions will act as additional nodes in the cluster.

parameter_groups:
- parameters:
  - keyname
  - image
  - floating-network-id
  - apps-network
  - flavor
  - db-username
  - db-user-password
  - db-remotehost
  - database

parameters:

  keyname:
    type: string
    label: Salt-Master Key Name
    description: Name of the key used to ssh into the Salt-Master.

  image:
    type: string
    label: Image Name
    description: Name of the existing image to use for every virtual machine created by this stack. The image should have the heat-config and heat-config-script files included.

  floating-network-id:
    type: string
    label: External Network UUID
    description: UUID of the external network. The private network created by this stack will route to this network. Any floating IP addresses needed by this stack will also route to this network.

  db-username:
    type: string
    label: Username to Create on the Database
    description: Username that will be created on the Galera cluster.

  db-user-password:
    type: string
    hidden: true
    label: Password for the Database Username
    description: Password for the database username specified.

  db-remotehost:
    type: string
    default: "%"
    label: Name of the Remote Host
    description: Hostname of the remote host that will have access to the database using the username specified above.

  apps-network:
    type: string
    label: Network UUID of Application Network
    description: Network UUID of the network where you run your applications (for example, Magento, Drupal).

  database:
    type: string
    label: Name of Database to Create for the Application
    description: Database name that will be created for the application.

  flavor:
    type: string
    label: Flavor
    description: Flavor (size) of the database instances.
    default: m1.small




resources:


  # Random string to aid in naming things.
  stack-string:
    type: OS::Heat::RandomString
    properties:
      length: 6
      sequence: lettersdigits

  # Will be used to generate a random password
  # 32 characters long consisting of alpha numeric characters
  secret:
    type: OS::Heat::RandomString
    properties:
      length: 32
      sequence: lettersdigits

  admin_password:
    type: OS::Heat::RandomString
    properties:
      length: 10
      sequence: lettersdigits

  #This is the security group for the haproxy node to allow mysql, web, icmp, and  ssh traffic
  secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name:
        str_replace:
          template: galera-$stackstr-secgroup
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      description: Ping, SSH, MySQL, web, salt, and galera replication traffic is allowed
      rules:
      - protocol: icmp
      - protocol: tcp
        port_range_min: 22
        port_range_max: 22
      - protocol: tcp
        port_range_min: 3306
        port_range_max: 3306
      - protocol: tcp
        port_range_min: 13306
        port_range_max: 13306
      - protocol: tcp
        port_range_min: 4505
        port_range_max: 4506
        remote_ip_prefix:
          get_attr:
            - subnet
            - cidr
      - protocol: tcp
        port_range_min: 4567
        port_range_max: 4568
        remote_ip_prefix:
          get_attr:
            - subnet
            - cidr
      - protocol: tcp
        port_range_min: 4444
        port_range_max: 4444
        remote_ip_prefix:
          get_attr:
            - subnet
            - cidr

  # Keypair for communicating between nodes within the stack.
  # Will allow minions to ssh into the master and vice versa.
  coms:
    type: OS::Nova::KeyPair
    properties:
      name:
        str_replace:
          template: galera-$stackstr-coms
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      save_private_key: true

  # Private network for this stack
  net:
    type: OS::Neutron::Net

  # Private subnet for this stack
  subnet:
    type: OS::Neutron::Subnet
    properties:
      network_id:
        get_resource: net
      cidr: 10.10.10.0/24
      dns_nameservers:
        - 8.8.8.8
        - 4.2.2.2

  # Routes the private network to the external network.
  router:
    type: OS::Neutron::Router
    properties:
      external_gateway_info:
        network:
          get_param: floating-network-id

  # Router interface
  interface:
    type: OS::Neutron::RouterInterface
    properties:
      router_id:
        get_resource: router
      subnet_id:
        get_resource: subnet

  # One floating ip for the salt-master node
  master-ip:
    type: OS::Neutron::FloatingIP
    properties:
      floating_network_id:
        get_param: floating-network-id

  # One port for the salt-master node
  master-port:
    type: OS::Neutron::Port
    properties:
      network_id:
        get_resource: net
      security_groups:
        - get_resource: secgroup
  apps-net-port:
    type: OS::Neutron::Port
    properties:
      network_id:
        get_param: apps-network
      security_groups:
        - {get_resource: secgroup}

  # Software configuration script for the salt-master node
  # Installs salt-master, sets permission on some personality files
  # and uses git to clone any provided state/formula repos
  config-salt-master:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
        - name: public_key
        - name: state_repos
      config: |
        #!/bin/bash
        set -ex
        logdir=/var/log/heat-deployments
        prefix=${logdir}/config-salt-master
        mkdir -p $logdir
        exec &> >(tee -a ${prefix}.log)
        [ -e ${prefix}.ran ] && exit 0

        chmod -R 0600 ${logdir}
        chmod 0700 /root/.ssh/coms_rsa
        chmod 0600 /srv/pillar/galera/init.sls

        # Add coms from minions to master
        echo "$public_key" >> /root/.ssh/authorized_keys

        # Install git
        apt-get install -y git

        # Install salt master
        echo "Install Salt Master"
        add-apt-repository ppa:saltstack/salt
        apt-get update -y
        apt-get install -y salt-master

        mkdir -p /srv/salt
        mkdir -p /srv/salt/orchestration
        mkdir -p /srv/pillar
        mkdir -p /srv/pillar/galera
        mkdir -p /srv/pillar/haproxy
        mkdir -p /srv/reactor
        echo -e 'file_roots:\n  base:\n    - /srv/salt' >> /etc/salt/master

        # Clone state/formula repos in state root directory
        cd /srv/salt
        while read -r line
        do
            if [ -n "$line" ]; then
                git clone $line
            fi
        done <<< "$state_repos"

        # Finally - Restart salt service
        service salt-master restart

        touch ${prefix}.ran

  # Software configuration for salt minion
  # Installs salt-minion, sets up authentication from minion to master,
  # and sets permissions of any personality files.
  config-salt-minion:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
        - name: public_key
        - name: master
      config: |
        #!/bin/bash
        set -ex
        logdir=/var/log/heat-deployments
        prefix=${logdir}/config-salt-minion
        mkdir -p $logdir
        exec &> >(tee -a ${prefix}.log)
        [ -e ${prefix}.ran ] && exit 0

        chmod -R 0600 ${logdir}
        chmod 0700 /root/.ssh/coms_rsa

        # Add coms from minions to master
        echo "$public_key" >> /root/.ssh/authorized_keys

        # Install salt minion
        add-apt-repository ppa:saltstack/salt
        apt-get update -y
        apt-get install -y salt-minion
        #Installing debconf-utils because deconf.set does not return
        apt-get install debconf-utils -y
        echo master: $master >> /etc/salt/minion
        service salt-minion restart
        rm /root/.ssh/coms_rsa

        #Configuring second interface on all nodes, even though haproxy is the
        #only node with two NICs.
        cat <<EOF > /etc/network/interfaces.d/eth1.cfg
        #File generated by Heat.
        auto eth1
        iface eth1 inet dhcp
        EOF

        #Bring up second nic, will ignore if eth1 does not exist.
        ifup eth1

        touch ${prefix}.ran

  # Software deployment for salt-master. Deploys the salt-master software
  # configuration.
  # Also lists the git repos necessary to make the galera stack work.
  deploy-salt-master:
    type: OS::Heat::SoftwareDeployment
    properties:
      input_values:
        public_key:
          get_attr:
            - coms
            - public_key
        state_repos: |
          https://github.com/rcbops/galera
          https://github.com/rcbops/base-hardening-formula
      config:
        get_resource: config-salt-master
      server:
        get_resource: master

  # The salt master instance
  # Should have one floating ip
  master:
    type: OS::Nova::Server
    depends_on: interface
    properties:
      key_name:
        get_param: keyname
      image:
        get_param: image
      flavor:
        get_param: flavor
      name:
        str_replace:
          template: galera-$stackstr-master
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      personality:

        # Private key for ssh'ing into minions
        /root/.ssh/coms_rsa:
          get_attr:
            - coms
            - private_key

        /etc/salt/master.d/reactor.conf: |
          reactor:
            - 'salt/auth':
              - /srv/reactor/auth-pending.sls

        /srv/reactor/auth-pending.sls: |
          {% if 'act' in data and data['act'] == 'pend' and data['id'].startswith('galera') %}
          minion_add:
            wheel.key.accept:
              - match: {{ data['id'] }}
          {% endif %}

        #The top.sls file for salt pillars
        #Dictates which minions get which pillars.
        /srv/pillar/top.sls: |
          base:
            '*':
              - galera

        #The galera pillar. Contains Some basic information for mariadb/galera config and installation
        /srv/pillar/galera/init.sls:
          str_replace:
            template: |
              interfaces:
                private: eth0
                public: eth0
              mine_functions:
                network.ip_addrs: [eth0]
                network.interfaces: []
              mine_interval: 1
              mdb_cfg_files:
                ubuntu_cluster:
                  path: /etc/mysql/conf.d/cluster.cnf
                  source: salt://galera/config/cluster.cnf
                ubuntu_maintenance:
                  path: /etc/mysql/debian.cnf
                  source: salt://galera/config/debian.cnf
              mdb_config:
                provider: /usr/lib/galera/libgalera_smm.so
              mdb_repo:
                baseurl: http://mirror.jmu.edu/pub/mariadb/repo/10.0/ubuntu
                keyserver: hkp://keyserver.ubuntu.com:80
                keyid: '0xcbcb082a1bb943db'
                file: /etc/apt/sources.list
              percona_repo:
                keyserver: keys.gnupg.net
                keyid: '1C4CBDCDCD2EFD2A'
                file: /etc/apt/sources.list
              user_via_heat:
                name: $user
                password: $password
                remotehost: "$remotehost"
              database:
                name: $database
              mysql_config:
                dbuser: root
                port: 3306
                socket: /var/lib/mysql/mysql.sock
                datadir: /var/lib/mysql/db_data
                maintenance_password: $pw
                admin_password: $admin_password
              user-ports:
                ssh:
                  chain: INPUT
                  proto: tcp
                  dport: 22
                salt-master:
                  chain: INPUT
                  proto: tcp
                  dport: 4505
                salt-minion:
                  chain: INPUT
                  proto: tcp
                  dport: 4506
                galera:
                  chain: INPUT
                  proto: tcp
                  dport: 4567
                rsync:
                  chain: INPUT
                  proto: tcp
                  dport: 4444
                mysql-read:
                  chain: INPUT
                  proto: tcp
                  dport: 3306
                mysql-write:
                  chain: INPUT
                  proto: tcp
                  dport: 13306
            params:
              $user:
                get_param: db-username
              $password:
                get_param: db-user-password
              $remotehost:
                get_param: db-remotehost
              $database:
                get_param: database
              $pw:
                get_attr:
                  - secret
                  - value
              $admin_password:
                get_attr:
                  - admin_password
                  - value

      # Get access from the master-port
      networks:
        - port:
            get_resource: master-port

      # Using SoftwareConfigs - This needs to be set to SOFTWARE_CONFIG
      user_data_format: SOFTWARE_CONFIG

  # Associate the master floating ip to the master port
  master-floating-ip-ass:
    type: OS::Neutron::FloatingIPAssociation
    properties:
      floatingip_id:
        get_resource: master-ip
      port_id:
        get_resource: master-port

  # Port for haproxy node
  minion-haproxy-port:
    type: OS::Neutron::Port
    properties:
      network_id:
        get_resource: net
      security_groups:
        - get_resource: secgroup

  # haproxy minion
  minion-haproxy:
    type: OS::Nova::Server
    depends_on: interface
    properties:
      flavor:
        get_param: flavor
      image:
        get_param: image
      name:
        str_replace:
          template: galera-$stackstr-haproxy
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      personality:

        # Private key for node to node communication
        /root/.ssh/coms_rsa:
          get_attr:
            - coms
            - private_key

        # Set the salt role to haproxy
        /etc/salt/grains: |
          roles:
            - haproxy

      networks:
        - port:
            get_resource: minion-haproxy-port
        - port:
            get_resource: apps-net-port

      # Needs to be SOFTWARE_CONFIG when using SoftwareConfigs
      user_data_format: SOFTWARE_CONFIG


  # Deploys the salt-minion software config to the haproxy node.
  deploy-haproxy:
    type: OS::Heat::SoftwareDeployment
    depends_on: deploy-salt-master
    properties:
      input_values:
        public_key:
          get_attr:
            - coms
            - public_key
        master:
          get_attr:
            - master
            - first_address
      config:
        get_resource: config-salt-minion
      server:
        get_resource: minion-haproxy

  # The bootstrap node of the cluster.
  minion-db-bootstrap:
    type: OS::Nova::Server
    depends_on: interface
    properties:
      image:
        get_param: image
      flavor:
        get_param: flavor
      name:
        str_replace:
          template: galera-$stackstr-db-bootstrap
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      personality:

        # Private key for node to node communications
        /root/.ssh/coms_rsa:
          get_attr:
            - coms
            - private_key

        # Set the salt-grain roles to ['db']
        /etc/salt/grains: |
          roles:
            - db_bootstrap

      networks:
        - network:
            get_resource: net
      security_groups:
        - get_resource: secgroup

      # This needs to be set to SOFTWARE_CONFIG when using SoftwareConfigs
      user_data_format: SOFTWARE_CONFIG


  # The db node of the cluster.
  minion-db2:
    type: OS::Nova::Server
    depends_on: interface
    properties:
      image:
        get_param: image
      flavor:
        get_param: flavor
      name:
        str_replace:
          template: galera-$stackstr-db2
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      personality:

        # Private key for node to node communications
        /root/.ssh/coms_rsa:
          get_attr:
            - coms
            - private_key

        # Set the salt-grain roles to ['db']
        /etc/salt/grains: |
          roles:
            - db

      networks:
        - network:
            get_resource: net
      security_groups:
        - get_resource: secgroup
      # This needs to be set to SOFTWARE_CONFIG when using SoftwareConfigs
      user_data_format: SOFTWARE_CONFIG



  # The db node of the cluster.
  minion-db3:
    type: OS::Nova::Server
    depends_on: interface
    properties:
      image:
        get_param: image
      flavor:
        get_param: flavor
      name:
        str_replace:
          template: galera-$stackstr-db3
          params:
            $stackstr:
              get_attr:
                - stack-string
                - value
      personality:

        # Private key for node to node communications
        /root/.ssh/coms_rsa:
          get_attr:
            - coms
            - private_key

        # Set the salt-grain roles to ['db']
        /etc/salt/grains: |
          roles:
            - db

      networks:
        - network:
            get_resource: net
      security_groups:
        - get_resource: secgroup
      # This needs to be set to SOFTWARE_CONFIG when using SoftwareConfigs
      user_data_format: SOFTWARE_CONFIG



  # Deploys the salt-minion software to the bootstrap node
  deploy-db-bootstrap:
    type: OS::Heat::SoftwareDeployment
    depends_on: deploy-salt-master
    properties:
      input_values:
        public_key:
          get_attr:
            - coms
            - public_key
        master:
          get_attr:
            - master
            - first_address
      config:
        get_resource: config-salt-minion
      server:
        get_resource: minion-db-bootstrap

  deploy-db2:
    type: OS::Heat::SoftwareDeployment
    depends_on: deploy-salt-master
    properties:
      input_values:
        public_key:
          get_attr:
            - coms
            - public_key
        master:
          get_attr:
            - master
            - first_address
      config:
        get_resource: config-salt-minion
      server:
        get_resource: minion-db2

  deploy-db3:
    type: OS::Heat::SoftwareDeployment
    depends_on: deploy-salt-master
    properties:
      input_values:
        public_key:
          get_attr:
            - coms
            - public_key
        master:
          get_attr:
            - master
            - first_address
      config:
        get_resource: config-salt-minion
      server:
        get_resource: minion-db3

  # SoftwareConfig that is to run on master.
  # Executes a salt state.highstate on all attached minions.
  config-deploy:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      config: |
        #!/bin/bash
        set -ex
        logdir=/var/log/heat-deployments
        prefix=${logdir}/config-deploy
        mkdir -p $logdir
        exec &> >(tee -a ${prefix}.log)
        [ -e ${prefix}.ran ] && exit 0
        salt '*' saltutil.refresh_pillar
        salt '*' mine.update
        salt-run state.sls galera.orchestration.galera_cluster
        salt '*' state.sls base-hardening-formula.base-hardening-formula
        touch ${prefix}.ran

  # Deploys the the deploy softwareconfig
  # All minions should be spun up and running salt-minion
  # before executing this deployment.
  deploy:
    type: OS::Heat::SoftwareDeployment
    properties:
      config:
        get_resource: config-deploy
      server:
        get_resource: master
    depends_on:
      - deploy-salt-master
      - deploy-db-bootstrap
      - deploy-haproxy
      - deploy-db2
      - deploy-db3

outputs:
  master-ip:
    value:
      get_attr:
        - master-ip
        - floating_ip_address

  minion-db-boostrap-ip:
    value:
      get_attr:
        - minion-db-bootstrap
        - first_address

  minion-db2:
    value:
      get_attr:
        - minion-db2
        - first_address

  minion-db3:
    value:
      get_attr:
        - minion-db3
        - first_address

  haproxy-ip:
    value:
      get_attr:
        - apps-net-port
        - fixed_ips
        - 0
        - ip_address