haproxy.yaml

heat_template_version: 2015-10-15

description: >
   This HEAT template creates a pair of servers running keepalived in a
   master / slave configuration controlling a virtual-ip address. It
   defines a neutron port for the VIP so that a floating IP address can 
   be associated, and then HAProxy is run on both servers to create an
   HA Load-Balancer service.
   Optionally deploys Consul and Consul-template for service discovery
   and dynamic load-balancer configuration.

parameters:
  key_name:
    type: string
    description: SSH Key Pair
    constraints:
      - custom_constraint: nova.keypair
  flavor:
    type: string
    description: Flavor to use for the haproxy server
    default: t1.small
    constraints:
      - custom_constraint: nova.flavor
  image:
    type: string
    description: Image ID or image name to use for the haproxy server
    default: "CentOS 7"
    constraints:
      - custom_constraint: glance.image
  router:
    type: string
    description: Name of the router used to connect to the external network
    default: InternetGW
  external_network:
    type: string
    description: Name of the external network used for floating ip addresses
    default: internet
  vrrp_subnet_cidr:
    type: string
    description: VRRP Subnet CIDR address
    default: 172.16.1.0/24
  vrrp_subnet_dns:
    type: string
    description: DNS Servers to configure on the vrrp subnet
    default: 8.8.8.8
  dmz_subnet_cidr:
    type: string
    description: DMZ Subnet CIDR address
    default: 10.0.0.0/24
  haproxy_ports:
    type: comma_delimited_list
    label: ports
    default: "80,443"
  deploy_consul:
    type: boolean
    description: Optionally deploy consul for service discovery
    default: false
  keepalived_password:
    type: string
    description: Password for keepalived encryption
    default: SUperS3creT

resources:
  vrrp_net:
    type: OS::Neutron::Net
    properties:
      admin_state_up: true
      name: vrrp_net

  vrrp_subnet:
    type: OS::Neutron::Subnet
    properties:
      name: vrrp_subnet
      network: { get_resource: vrrp_net }
      allocation_pools:
        - start: 
            list_join: ['.', [ str_split: ['.', { get_param: vrrp_subnet_cidr }, 0], str_split: ['.', { get_param: vrrp_subnet_cidr }, 1], str_split: ['.', { get_param: vrrp_subnet_cidr }, 2], '20' ]] 
          end: 
            list_join: ['.', [ str_split: ['.', { get_param: vrrp_subnet_cidr }, 0], str_split: ['.', { get_param: vrrp_subnet_cidr }, 1], str_split: ['.', { get_param: vrrp_subnet_cidr }, 2], '200' ]]
      cidr: { get_param: vrrp_subnet_cidr }
      dns_nameservers: [ { get_param: vrrp_subnet_dns } ]
      gateway_ip: 
        list_join: ['.', [ str_split: ['.', { get_param: vrrp_subnet_cidr }, 0], str_split: ['.', { get_param: vrrp_subnet_cidr }, 1], str_split: ['.', { get_param: vrrp_subnet_cidr }, 2], '1' ]]
      ip_version: 4

  vrrp_gw:
    type: OS::Neutron::RouterInterface
    properties:
      router: { get_param: router }
      subnet: { get_resource: vrrp_subnet }

  haproxy_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
        - direction: ingress
          protocol: 112
          remote_group_id:
          remote_mode: remote_group_id
        - direction: ingress
          protocol: icmp
          remote_ip_prefix: 0.0.0.0/0
        - direction: ingress
          protocol: tcp
          remote_ip_prefix: 0.0.0.0/0
          port_range_min: 80
          port_range_max: 80

  ssh_int_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
        - protocol: tcp
          remote_ip_prefix: { get_param: vrrp_subnet_cidr }
          port_range_min: 22
          port_range_max: 22
        - protocol: tcp
          remote_ip_prefix: { get_param: dmz_subnet_cidr }
          port_range_min: 22
          port_range_max: 22

  # consul_secgroup:
  #   type: OS::Neutron::SecurityGroup
  #   properties:
  #     rules:
  #       - direction: ingress
  #         protocol: tcp
  #         remote_group_id:
  #         remote_mode: remote_group_id
  #         port_range_min: 8300
  #         port_range_max: 8302
  #       - direction: ingress
  #         protocol: udp
  #         remote_group_id:
  #         remote_mode: remote_group_id
  #         port_range_min: 8301
  #         port_range_max: 8302
  #       - direction: ingress
  #         protocol: tcp
  #         remote_group_id:
  #         remote_mode: remote_group_id
  #         port_range_min: 8400
  #         port_range_max: 8400
  #       - direction: ingress
  #         protocol: tcp
  #         remote_group_id:
  #         remote_mode: remote_group_id
  #         port_range_min: 8500
  #         port_range_max: 8500
  #       - direction: ingress
  #         protocol: tcp
  #         remote_group_id:
  #         remote_mode: remote_group_id
  #         port_range_min: 8600
  #         port_range_max: 8600
  #       - direction: ingress
  #         protocol: udp
  #         remote_group_id:
  #         remote_mode: remote_group_id
  #         port_range_min: 8600
  #         port_range_max: 8600

  haproxy_vip_port:
    type: OS::Neutron::Port
    properties:
      network: { get_resource: vrrp_net }
      fixed_ips:
        - ip_address:
            list_join: ['.', [ str_split: ['.', { get_param: vrrp_subnet_cidr }, 0], str_split: ['.', { get_param: vrrp_subnet_cidr }, 1], str_split: ['.', { get_param: vrrp_subnet_cidr }, 2], '201' ]]
      security_groups:
        - { get_resource: haproxy_secgroup }

  haproxy_ip:
    type: OS::Neutron::FloatingIP
    properties:
      floating_network: { get_param: external_network }
      port_id: { get_resource: haproxy_vip_port }
    depends_on: vrrp_gw

  haproxy_1_port:
    type: OS::Neutron::Port
    properties:
      network: { get_resource: vrrp_net }
      allowed_address_pairs:
        - ip_address:
            list_join: ['.', [ str_split: ['.', { get_param: vrrp_subnet_cidr }, 0], str_split: ['.', { get_param: vrrp_subnet_cidr }, 1], str_split: ['.', { get_param: vrrp_subnet_cidr }, 2], '201' ]]
      fixed_ips:
        - subnet_id: { get_resource: vrrp_subnet }
      security_groups:
        - { get_resource: haproxy_secgroup }
        - { get_resource: ssh_int_secgroup }
        # - { get_resource: consul_secgroup }

  haproxy_2_port:
    type: OS::Neutron::Port
    properties:
      network: { get_resource: vrrp_net }
      allowed_address_pairs:
        - ip_address:
            list_join: ['.', [ str_split: ['.', { get_param: vrrp_subnet_cidr }, 0], str_split: ['.', { get_param: vrrp_subnet_cidr }, 1], str_split: ['.', { get_param: vrrp_subnet_cidr }, 2], '201' ]]
      fixed_ips:
        - subnet_id: { get_resource: vrrp_subnet }
      security_groups:
        - { get_resource: haproxy_secgroup }
        - { get_resource: ssh_int_secgroup }
        # - { get_resource: consul_secgroup }

  haproxy_cluster:
    type: OS::Nova::ServerGroup
    properties:
      name: Haproxy Cluster
      policies: ['anti-affinity']

  haproxy_1_server:
    type: OS::Nova::Server
    properties:
      name: haproxy01
      flavor: { get_param: flavor }
      image: { get_param: image }
      key_name: { get_param: key_name }
      scheduler_hints: { group: { get_resource: haproxy_cluster }}
      networks:
        - port: { get_resource: haproxy_1_port }
      user_data_format: SOFTWARE_CONFIG
      user_data: { get_attr: [config_agent, config] }

  haproxy_2_server:
    type: OS::Nova::Server
    properties:
      name: haproxy02
      flavor: { get_param: flavor }
      image: { get_param: image }
      key_name: { get_param: key_name }
      scheduler_hints: { group: { get_resource: haproxy_cluster }}
      networks:
        - port: { get_resource: haproxy_2_port }
      user_data_format: SOFTWARE_CONFIG
      user_data: { get_attr: [config_agent, config] }

  # Install, configure and enable the Heat configuration agent
  config_agent:
    type: collect-config-setup/install_config_agent_centos_yum.yaml

  keepalived_config:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
      - name: state
      - name: priority
      - name: password
      outputs:
      - name: result
      config: 
        str_replace:
          template:  { get_file: 'files/keepalived.conf' }
          params:
            $vip: { get_attr: [haproxy_vip_port, fixed_ips, 0, ip_address] }

  keepalived_master_config:
    type: OS::Heat::SoftwareDeployment
    properties:
      signal_transport: CFN_SIGNAL
      config:
        get_resource: keepalived_config
      server:
        get_resource: haproxy_1_server
      input_values:
        state: MASTER
        priority: 100
        password: { get_param: keepalived_password }

  keepalived_slave_config:
    type: OS::Heat::SoftwareDeployment
    properties:
      signal_transport: CFN_SIGNAL
      config:
        get_resource: keepalived_config
      server:
        get_resource: haproxy_2_server
      input_values:
        state: BACKUP
        priority: 50
        password: { get_param: keepalived_password }

  install_software:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
      - name: deploy_consul
      config: { get_file: 'files/install_software.sh' }

  deploy_software:
    type: OS::Heat::SoftwareDeploymentGroup
    depends_on: [ keepalived_master_config, keepalived_slave_config ]
    properties:
      config:
        get_resource: install_software
      servers:
        haproxy01: { get_resource: haproxy_1_server }
        haproxy02: { get_resource: haproxy_2_server }
      input_values:
        deploy_consul: { get_param: deploy_consul }

  haproxy_config:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      config: 
        str_replace:
          template: { get_file: 'files/haproxy.cfg' }
          params:
            $vip: { get_attr: [haproxy_vip_port, fixed_ips, 0, ip_address] }

  deploy_haproxy_config:
    type: OS::Heat::SoftwareDeploymentGroup
    depends_on: [ deploy_software ]
    properties:
      config:
        get_resource: haproxy_config
      servers:
        haproxy01: { get_resource: haproxy_1_server }
        haproxy02: { get_resource: haproxy_2_server }