Implement containers for heat-engine and heat-api

Loosely followed this document for setting up Heat:
http://docs.openstack.org/icehouse/install-guide/install/yum/content/heat-install.html

Some gotchas:
- crux doesn't require escaping parenthesis for endpoint creation like
  keystone client
- heat icehouse packages are configured for qpid, so kombu had to be
  specified specifically

This firewall reference was handy for port information:
http://docs.openstack.org/trunk/config-reference/content/firewalls-default-ports.html

Implements: blueprint kube-heat-container

Change-Id: Ie4291a6c4c2b85a23a71fc0a003d9160bf0a32b8

7 files changed, 137 insertions, 59 deletions

diff --git a/docker/heat/heat-api/Dockerfile b/docker/heat/heat-api/Dockerfile
index 44ff6ed93..2bb25e45e 100644
--- a/docker/heat/heat-api/Dockerfile
+++ b/docker/heat/heat-api/Dockerfile
@@ -1,14 +1,14 @@
-FROM kollaglue/fedora-rdo-base
-MAINTAINER James Labocki <jlabocki@redhat.com>
+FROM kollaglue/fedora-rdo-heat-base
+MAINTAINER Jeff Peeler <jpeeler@redhat.com>
 
-RUN yum install -y openstack-heat-api \
-	openstack-heat-api-cfn \
-	openstack-heat-common \
-	openstack-heat-api-cloudwatch \
-	openstack-utils \
-	python-openstackclient \
-	&& yum clean all
+# TODO: configure cfn and cloudwatch
+# TODO: remove python-openstackclient once crux feature is added in start.sh
+RUN yum -y install \
+    openstack-heat-api \
+    python-openstackclient \
+    ; yum clean all
 
 ADD ./start.sh /start.sh
+ADD ./check.sh /check.sh
 
 CMD ["/start.sh"]
diff --git a/docker/heat/heat-api/check.sh b/docker/heat/heat-api/check.sh
new file mode 100755
index 000000000..eab8ee59b
--- /dev/null
+++ b/docker/heat/heat-api/check.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+RES=0
+
+. /openrc
+if ! keystone token-get > /dev/null; then
+    echo "ERROR: keystone token-get failed" >&2
+    RES=1
+else
+    if ! heat stack-list > /dev/null; then
+        echo "ERROR: heat stack-list failed" >&2
+        RES=1
+    fi
+fi
+
+exit $RES
diff --git a/docker/heat/heat-api/start.sh b/docker/heat/heat-api/start.sh
index 8f73ae3e2..b6565c207 100644..100755
--- a/docker/heat/heat-api/start.sh
+++ b/docker/heat/heat-api/start.sh
@@ -1,13 +1,34 @@
 #!/bin/bash
 set -e
 
-: ${IP_ADDRESS:=$IP_ADDRESS}
+. /opt/kolla/kolla-common.sh
+. /opt/kolla/config-heat.sh
 
-if [ -z "$IP_ADDRESS" ]; then
-	echo >&2 'error: IP_ADDRESS is not set.'
-	echo >&2 '   Be sure to set IP_ADDRESS so it can be placed in heat configurations'
-	exit 1
-fi
+check_required_vars KEYSTONE_ADMIN_TOKEN KEYSTONE_ADMIN_SERVICE_HOST \
+                    HEAT_KEYSTONE_USER HEAT_KEYSTONE_PASSWORD \
+                    KEYSTONE_AUTH_PROTOCOL ADMIN_TENANT_NAME \
+                    HEAT_API_SERVICE_HOST PUBLIC_IP
 
+check_for_keystone
+
+export SERVICE_TOKEN="${KEYSTONE_ADMIN_TOKEN}"
+export SERVICE_ENDPOINT="${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_ADMIN_SERVICE_HOST}:35357/v2.0"
+crux user-create -n ${HEAT_KEYSTONE_USER} \
+    -p ${HEAT_KEYSTONE_PASSWORD} \
+    -t ${ADMIN_TENANT_NAME} \
+    -r admin
+
+crux endpoint-create --remove-all -n ${HEAT_KEYSTONE_USER} -t orchestration \
+    -I "${KEYSTONE_AUTH_PROTOCOL}://${HEAT_API_SERVICE_HOST}:8004/v1/%(tenant_id)s" \
+    -P "${KEYSTONE_AUTH_PROTOCOL}://${PUBLIC_IP}:8004/v1/%(tenant_id)s" \
+    -A "${KEYSTONE_AUTH_PROTOCOL}://${HEAT_API_SERVICE_HOST}:8004/v1/%(tenant_id)s"
+
+#crux endpoint-create --remove-all -n ${HEAT_KEYSTONE_USER} -t cloudformation \
+#    -I "http://${HEAT_CFN_API_SERVICE_HOST}:8000/v1" \
+#    -P "http://${PUBLIC_IP}:8000/v1" \
+#    -A "http://${HEAT_CFN_API_SERVICE_HOST}:8000/v1"
+
+# will use crux after https://github.com/larsks/crux/issues/1 is implemented
+openstack role list --os-token="${KEYSTONE_ADMIN_TOKEN}" --os-url $SERVICE_ENDPOINT -f csv | tail -n +2 | awk -F, '{print $2}' | grep heat_stack_user || keystone role-create --name heat_stack_user
 
 exec /usr/bin/heat-api
diff --git a/docker/heat/heat-base/Dockerfile b/docker/heat/heat-base/Dockerfile
index 1904d189c..1bc0c6c8e 100644
--- a/docker/heat/heat-base/Dockerfile
+++ b/docker/heat/heat-base/Dockerfile
@@ -1,10 +1,5 @@
-FROM fedora-rdo-base
-MAINTAINER Steven Dake <sdake@redhat.com>
+FROM kollaglue/fedora-rdo-base
+MAINTAINER Jeff Peeler <jpeeler@redhat.com>
 
-RUN yum -y install \
-	openstack-utils \
-	openstack-heat && yum clean all
-
-# These will come after we sort out start time config
-#RUN mkdir /opt/heat
-#COPY config-heat.sh /opt/heat/config-heat.sh
+RUN mkdir -p /opt/kolla
+COPY config-heat.sh /opt/kolla/config-heat.sh
diff --git a/docker/heat/heat-base/config-heat.sh b/docker/heat/heat-base/config-heat.sh
new file mode 100755
index 000000000..c2837325c
--- /dev/null
+++ b/docker/heat/heat-base/config-heat.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+set -e
+
+. /opt/kolla/kolla-common.sh
+
+: ${ADMIN_TENANT_NAME:=admin}
+: ${HEAT_DB_NAME:=heat}
+: ${HEAT_DB_USER:=heat}
+: ${HEAT_KEYSTONE_USER:=heat}
+: ${KEYSTONE_AUTH_PROTOCOL:=http}
+: ${PUBLIC_IP:=$HEAT_API_PORT_8004_TCP_ADDR}
+: ${RABBIT_USER:=guest}
+: ${RABBIT_PASSWORD:=guest}
+
+check_required_vars HEAT_DB_PASSWORD HEAT_KEYSTONE_PASSWORD
+dump_vars
+
+cat > /openrc <<EOF
+export OS_AUTH_URL="http://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+export OS_USERNAME="${HEAT_KEYSTONE_USER}"
+export OS_PASSWORD="${HEAT_KEYSTONE_PASSWORD}"
+export OS_TENANT_NAME="${ADMIN_TENANT_NAME}"
+EOF
+
+crudini --set /etc/heat/heat.conf DEFAULT log_file \
+    ""
+crudini --set /etc/heat/heat.conf DEFAULT use_stderr \
+    true
+crudini --set /etc/heat/heat.conf DEFAULT rpc_backend \
+    heat.openstack.common.rpc.impl_kombu
+crudini --set /etc/heat/heat.conf DEFAULT rabbit_host \
+    ${RABBITMQ_SERVICE_HOST}
+crudini --set /etc/heat/heat.conf DEFAULT rabbit_userid \
+    ${RABBIT_USER}
+crudini --set /etc/heat/heat.conf DEFAULT rabbit_password \
+    ${RABBIT_PASSWORD}
+
+crudini --set /etc/heat/heat.conf database connection \
+    mysql://${HEAT_DB_USER}:${HEAT_DB_PASSWORD}@${MARIADB_SERVICE_HOST}/${HEAT_DB_NAME}
+
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_protocol \
+    "${KEYSTONE_AUTH_PROTOCOL}"
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_host \
+    "${KEYSTONE_PUBLIC_SERVICE_HOST}"
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_port \
+    5000
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_uri \
+    "${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+crudini --set /etc/heat/heat.conf  keystone_authtoken admin_tenant_name \
+    "${ADMIN_TENANT_NAME}"
+crudini --set /etc/heat/heat.conf keystone_authtoken admin_user \
+    "${HEAT_KEYSTONE_USER}"
+crudini --set /etc/heat/heat.conf keystone_authtoken admin_password \
+    "${HEAT_KEYSTONE_PASSWORD}"
+
+crudini --set /etc/heat/heat.conf ec2authtoken auth_uri \
+    "${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+
+# cfn
+#crudini --set /etc/heat/heat.conf DEFAULT heat_metadata_server_url \
+#    http://${HEAT_CFN_API_SERVICE_HOST}:8000
+#crudini --set /etc/heat/heat.conf DEFAULT heat_waitcondition_server_url \
+#    http://${HEAT_CFN_API_SERVICE_HOST}:8000/v1/waitcondition
+
diff --git a/docker/heat/heat-engine/Dockerfile b/docker/heat/heat-engine/Dockerfile
index 49b80e1f6..163e97a2d 100644
--- a/docker/heat/heat-engine/Dockerfile
+++ b/docker/heat/heat-engine/Dockerfile
@@ -1,6 +1,9 @@
-FROM fedora-rdo-base
-MAINTAINER Steven Dake <sdake@redhat.com>
+FROM kollaglue/fedora-rdo-heat-base
+MAINTAINER Jeff Peeler <jpeeler@redhat.com>
+
+RUN yum -y install \
+    openstack-heat-engine \
+    ; yum clean all
 
 ADD ./start.sh /start.sh
 CMD ["/start.sh"]
-
diff --git a/docker/heat/heat-engine/start.sh b/docker/heat/heat-engine/start.sh
index 306cbbace..0ab9e4800 100644..100755
--- a/docker/heat/heat-engine/start.sh
+++ b/docker/heat/heat-engine/start.sh
@@ -1,40 +1,18 @@
 #!/bin/sh
 
-: ${GLANCE_DB_USER:=heat}
-: ${GLANCE_DB_NAME:=heat}
-: ${KEYSTONE_AUTH_PROTOCOL:=http}
-: ${GLANCE_KEYSTONE_USER:=heat}
-: ${ADMIN_TENANT_NAME:=admin}
+. /opt/kolla/kolla-common.sh
+. /opt/kolla/config-heat.sh
 
-if ! [ "$KEYSTONE_ADMIN_TOKEN" ]; then
-	echo "*** Missing KEYSTONE_ADMIN_TOKEN" >&2
-	exit 1
-fi
+check_required_vars MARIADB_SERVICE_HOST DB_ROOT_PASSWORD \
+                    HEAT_DB_NAME HEAT_DB_USER HEAT_DB_PASSWORD
+check_for_db
 
-if ! [ "$DB_ROOT_PASSWORD" ]; then
-	echo "*** Missing DB_ROOT_PASSWORD" >&2
-	exit 1
-fi
-
-if ! [ "$GLANCE_DB_PASSWORD" ]; then
-	GLANCE_DB_PASSWORD=$(openssl rand -hex 15)
-	export GLANCE_DB_PASSWORD
-fi
-
-sh /opt/heat/config-heat.sh engine
-
-mysql -h ${MARIADB_PORT_3306_TCP_ADDR} -u root \
-	-p${DB_ROOT_PASSWORD} mysql <<EOF
-CREATE DATABASE IF NOT EXISTS ${GLANCE_DB_NAME};
-GRANT ALL PRIVILEGES ON heat* TO
-	'${GLANCE_DB_USER}'@'%' IDENTIFIED BY '${GLANCE_DB_PASSWORD}'
+mysql -h ${MARIADB_SERVICE_HOST} -u root -p${DB_ROOT_PASSWORD} mysql <<EOF
+CREATE DATABASE IF NOT EXISTS ${HEAT_DB_NAME} DEFAULT CHARACTER SET utf8;
+GRANT ALL PRIVILEGES ON ${HEAT_DB_NAME}.* TO
+    '${HEAT_DB_USER}'@'%' IDENTIFIED BY '${HEAT_DB_PASSWORD}'
 EOF
 
-export SERVICE_TOKEN="${KEYSTONE_ADMIN_TOKEN}"
-export SERVICE_ENDPOINT="${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_ADMIN_PORT_35357_TCP_ADDR}:35357/v2.0"
-
-/bin/keystone user-create --name ${GLANCE_KEYSTONE_USER} --pass ${GLANCE_ADMIN_PASSWORD}
-/bin/keystone role-create --name ${GLANCE_KEYSTONE_USER}
-/bin/keystone user-role-add --user ${GLANCE_KEYSTONE_USER} --role admin --tenant ${ADMIN_TENANT_NAME}
+/usr/bin/heat-manage db_sync
 
 exec /usr/bin/heat-engine