Add security group to vFW, vLB

[demo.git] / heat / vFW / base_vfw.yaml

diff --git a/heat/vFW/base_vfw.yaml b/heat/vFW/base_vfw.yaml
index ace7c5e..e8a0555 100644 (file)
--- a/heat/vFW/base_vfw.yaml
+++ b/heat/vFW/base_vfw.yaml
@@ -137,10 +137,6 @@ parameters:
     type: string
     label: Public key
     description: Public key to be installed on the compute instance
-  repo_url_blob:
-    type: string
-    label: Repository URL
-    description: URL of the repository that hosts the demo packages
   repo_url_artifacts:
     type: string
     label: Repository URL
@@ -153,10 +149,17 @@ parameters:
     type: string
     label: Artifacts version used in demo vnfs
     description: Artifacts (jar, tar.gz) version used in demo vnfs
+  nexus_artifact_repo:
+    type: string
+    description: Root URL for the Nexus repository for Maven artifacts.
+    default: "https://nexus.onap.org"
   cloud_env:
     type: string
     label: Cloud environment
     description: Cloud environment (e.g., openstack, rackspace)
+  sec_group:
+    type: string
+    description: ONAP Security Group
 
 #############
 #           #
@@ -210,6 +213,8 @@ resources:
     properties:
       network: { get_resource: unprotected_private_network }
       fixed_ips: [{"subnet": { get_resource: unprotected_private_subnet }, "ip_address": { get_param: vfw_private_ip_0 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vfw_private_1_port:
     type: OS::Neutron::Port
@@ -217,12 +222,16 @@ resources:
       allowed_address_pairs: [{ "ip_address": { get_param: vpg_private_ip_0 }}]
       network: { get_resource: protected_private_network }
       fixed_ips: [{"subnet": { get_resource: protected_private_subnet }, "ip_address": { get_param: vfw_private_ip_1 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vfw_private_2_port:
     type: OS::Neutron::Port
     properties:
       network: { get_param: onap_private_net_id }
       fixed_ips: [{"subnet": { get_param: onap_private_subnet_id }, "ip_address": { get_param: vfw_private_ip_2 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vfw_0:
     type: OS::Nova::Server
@@ -243,7 +252,6 @@ resources:
           params:
             __dcae_collector_ip__ : { get_param: dcae_collector_ip }
             __dcae_collector_port__ : { get_param: dcae_collector_port }
-            __repo_url_blob__ : { get_param: repo_url_blob }
             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
             __install_script_version__ : { get_param: install_script_version }
@@ -254,6 +262,7 @@ resources:
             __protected_private_net_cidr__ : { get_param: protected_private_net_cidr }
             __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
             __cloud_env__ : { get_param: cloud_env }
+            __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
           template: |
             #!/bin/bash
 
@@ -261,7 +270,6 @@ resources:
             mkdir /opt/config
             echo "__dcae_collector_ip__" > /opt/config/dcae_collector_ip.txt
             echo "__dcae_collector_port__" > /opt/config/dcae_collector_port.txt
-            echo "__repo_url_blob__" > /opt/config/repo_url_blob.txt
             echo "__repo_url_artifacts__" > /opt/config/repo_url_artifacts.txt
             echo "__demo_artifacts_version__" > /opt/config/demo_artifacts_version.txt
             echo "__install_script_version__" > /opt/config/install_script_version.txt
@@ -272,9 +280,13 @@ resources:
             echo "__protected_private_net_cidr__" > /opt/config/protected_private_net_cidr.txt
             echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
             echo "__cloud_env__" > /opt/config/cloud_env.txt
+            echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 
             # Download and run install script
-            curl -k __repo_url_blob__/org.onap.demo/vnfs/vfw/__install_script_version__/v_firewall_install.sh -o /opt/v_firewall_install.sh
+            apt-get -y install unzip
+            if [[ "__install_script_version__" =~ "SNAPSHOT" ]]; then REPO=snapshots; else REPO=releases; fi
+            curl -k -L "__nexus_artifact_repo__/service/local/artifact/maven/redirect?r=${REPO}&g=org.onap.demo.vnf.vfw&a=vfw-scripts&e=zip&v=__install_script_version__" -o /opt/vfw-scripts-__install_script_version__.zip
+            unzip -j /opt/vfw-scripts-__install_script_version__.zip -d /opt v_firewall_install.sh
             cd /opt
             chmod +x v_firewall_install.sh
             ./v_firewall_install.sh
@@ -286,12 +298,16 @@ resources:
     properties:
       network: { get_resource: unprotected_private_network }
       fixed_ips: [{"subnet": { get_resource: unprotected_private_subnet }, "ip_address": { get_param: vpg_private_ip_0 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vpg_private_1_port:
     type: OS::Neutron::Port
     properties:
       network: { get_param: onap_private_net_id }
       fixed_ips: [{"subnet": { get_param: onap_private_subnet_id }, "ip_address": { get_param: vpg_private_ip_1 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vpg_0:
     type: OS::Nova::Server
@@ -312,7 +328,6 @@ resources:
             __fw_ipaddr__: { get_param: vfw_private_ip_0 }
             __protected_net_cidr__: { get_param: protected_private_net_cidr }
             __sink_ipaddr__: { get_param: vsn_private_ip_0 }
-            __repo_url_blob__ : { get_param: repo_url_blob }
             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
             __install_script_version__ : { get_param: install_script_version }
@@ -321,6 +336,7 @@ resources:
             __unprotected_private_net_cidr__ : { get_param: unprotected_private_net_cidr }
             __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
             __cloud_env__ : { get_param: cloud_env }
+            __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
           template: |
             #!/bin/bash
 
@@ -329,7 +345,6 @@ resources:
             echo "__fw_ipaddr__" > /opt/config/fw_ipaddr.txt
             echo "__protected_net_cidr__" > /opt/config/protected_net_cidr.txt
             echo "__sink_ipaddr__" > /opt/config/sink_ipaddr.txt
-            echo "__repo_url_blob__" > /opt/config/repo_url_blob.txt
             echo "__repo_url_artifacts__" > /opt/config/repo_url_artifacts.txt
             echo "__demo_artifacts_version__" > /opt/config/demo_artifacts_version.txt
             echo "__install_script_version__" > /opt/config/install_script_version.txt
@@ -338,9 +353,13 @@ resources:
             echo "__unprotected_private_net_cidr__" > /opt/config/unprotected_private_net_cidr.txt
             echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
             echo "__cloud_env__" > /opt/config/cloud_env.txt
+            echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 
             # Download and run install script
-            curl -k __repo_url_blob__/org.onap.demo/vnfs/vfw/__install_script_version__/v_packetgen_install.sh -o /opt/v_packetgen_install.sh
+            apt-get -y install unzip
+            if [[ "__install_script_version__" =~ "SNAPSHOT" ]]; then REPO=snapshots; else REPO=releases; fi
+            curl -k -L "__nexus_artifact_repo__/service/local/artifact/maven/redirect?r=${REPO}&g=org.onap.demo.vnf.vfw&a=vfw-scripts&e=zip&v=__install_script_version__" -o /opt/vfw-scripts-__install_script_version__.zip
+            unzip -j /opt/vfw-scripts-__install_script_version__.zip -d /opt v_packetgen_install.sh
             cd /opt
             chmod +x v_packetgen_install.sh
             ./v_packetgen_install.sh
@@ -352,12 +371,16 @@ resources:
     properties:
       network: { get_resource: protected_private_network }
       fixed_ips: [{"subnet": { get_resource: protected_private_subnet }, "ip_address": { get_param: vsn_private_ip_0 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vsn_private_1_port:
     type: OS::Neutron::Port
     properties:
       network: { get_param: onap_private_net_id }
       fixed_ips: [{"subnet": { get_param: onap_private_subnet_id }, "ip_address": { get_param: vsn_private_ip_1 }}]
+      security_groups:
+      - { get_param: sec_group }
 
   vsn_0:
     type: OS::Nova::Server
@@ -377,7 +400,6 @@ resources:
           params:
             __protected_net_gw__: { get_param: vfw_private_ip_1 }
             __unprotected_net__: { get_param: unprotected_private_net_cidr }
-            __repo_url_blob__ : { get_param: repo_url_blob }
             __repo_url_artifacts__ : { get_param: repo_url_artifacts }
             __install_script_version__ : { get_param: install_script_version }
             __vsn_private_ip_0__ : { get_param: vsn_private_ip_0 }
@@ -385,6 +407,7 @@ resources:
             __protected_private_net_cidr__ : { get_param: protected_private_net_cidr }
             __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
             __cloud_env__ : { get_param: cloud_env }
+            __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
           template: |
             #!/bin/bash
 
@@ -392,16 +415,19 @@ resources:
             mkdir /opt/config
             echo "__protected_net_gw__" > /opt/config/protected_net_gw.txt
             echo "__unprotected_net__" > /opt/config/unprotected_net.txt
-            echo "__repo_url_blob__" > /opt/config/repo_url_blob.txt
             echo "__install_script_version__" > /opt/config/install_script_version.txt
             echo "__vsn_private_ip_0__" > /opt/config/vsn_private_ip_0.txt
             echo "__vsn_private_ip_1__" > /opt/config/vsn_private_ip_1.txt
             echo "__protected_private_net_cidr__" > /opt/config/protected_private_net_cidr.txt
             echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
             echo "__cloud_env__" > /opt/config/cloud_env.txt
+            echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 
             # Download and run install script
-            curl -k __repo_url_blob__/org.onap.demo/vnfs/vfw/__install_script_version__/v_sink_install.sh -o /opt/v_sink_install.sh
+            apt-get -y install unzip
+            if [[ "__install_script_version__" =~ "SNAPSHOT" ]]; then REPO=snapshots; else REPO=releases; fi
+            curl -k -L "__nexus_artifact_repo__/service/local/artifact/maven/redirect?r=${REPO}&g=org.onap.demo.vnf.vfw&a=vfw-scripts&e=zip&v=__install_script_version__" -o /opt/vfw-scripts-__install_script_version__.zip
+            unzip -j /opt/vfw-scripts-__install_script_version__.zip -d /opt v_sink_install.sh
             cd /opt
             chmod +x v_sink_install.sh
             ./v_sink_install.sh
\ No newline at end of file