# Copyright 2017-2020 Canonical Ltd. All rights reserved.
#
# Foundation HyperConverged
#
series: bionic
variables:
  # https://wiki.ubuntu.com/OpenStack/CloudArchive
  # packages for an LTS release come in a form of SRUs
  # do not use cloud:<pocket> for an LTS version as
  # installation hooks will fail. Example:
  openstack-origin:    &openstack-origin    cloud:bionic-stein

  openstack-region:    &openstack-region    RegionOne

  # !> Important <!
  # configure that value for the API services as if they
  # spawn too many workers you will get inconsistent failures
  # due to CPU overcommit
  worker-multiplier:   &worker-multiplier   0.25

  # Number of MySQL connections in the env. Default is not enough
  # for environment of this size. So, bundle declares default of
  # 2000. There's hardly a case for higher than this
  mysql-connections:   &mysql-connections   2000

  # Timeout for idle connections. After this many seconds the
  # mysql server will sever conns that didn't sent queries.
  # A timeout 3600s of aligns to Openstacks connection_recycle_time
  mysql-wait-timeout: &mysql-wait-timeout  3600

  # MySQL tuning level. Charm default is "safest", this however
  # impacts performance. For spinning platters consider setting this
  # to "fast"
  mysql-tuning-level:  &mysql-tuning-level safest

  # MySQL InnoDB Buffer Pool Size: Specifies the amount of
  # memory allocated to the InnoDB buffer pool by MySQL.
  # Should be configured based on the available system RAM
  # (typically 70% – 80% of the system RAM.)
  mysql-innodb-buffer-pool-size: &mysql-innodb-buffer-pool-size 8G

  # The per physical core -> virtual core ratio to use in the Nova scheduler.
  # Note: This option affects the whole cloud.
  # Increase it for achieving more density in the cloud.
  cpu-allocation-ratio: &cpu-allocation-ratio 16

  # Configure RAM allocation params for nova. For hyperconverged
  # nodes, we need to have plenty reserves for service containers,
  # Ceph OSDs, and swift-storage daemons. Those processes will not
  # only directly allocate RAM but also indirectly via pagecache, file
  # system caches, system buffers usage.  Adjust for higher density
  # clouds, e.g. high OSD/host ratio or when running >2 service
  # containers/host adapt appropriately.
  reserved-host-memory: &reserved-host-memory 16384
  ram-allocation-ratio: &ram-allocation-ratio 1.0

  # Configure the data-port by replacing FCE_TEMPLATE with the
  # correct value. Do not change 'br-data'. This port will be used by
  # neutron-gateway and possibly neutron-openvswitch to provide connectivity
  # to a physical network, therefore, do not configure an IP address for this
  # port in MAAS. You have two choices of configuration:
  # 1) A raw bond interface for neutron-gateway and neutron-openvswitch charms,
  #    i.e: data-port: br-data:bond0
  #         bridge-mappings: dcfabric:br-data
  #         flat-network-providers:    #left intentionally blank
  #         vlan-ranges: dcfabric
  #    Note 1.1) No vlan range specified - only a physnet which means no vlan
  #    tenant networks and all vlan networks are provider networks created by
  #    admin user with a specific segmentation ID. Physnets correspond to
  #    fabrics in MAAS. Each fabric has its own set of independant VLANs
  #    from 1-4094.
  #    Note 1.2) Allows for dynamic addition of vlan provider networks
  #    Note 1.3) For Neutron-API, make sure that the vlan-ranges matches.
  # 2) flat provider networks with bonds for the data-port,
  #    i.e: data-port: br-100:bond0.100 br-101:bond0.101
  #         bridge-mappings: physnetvlan100:br-100 physnetvlan101:br-101
  #         flat-network-providers: physnetvlan100 physnetvlan101
  #         vlan-ranges:    '' #Charm default cleared
  #    Note 2.1) A VLAN port can be used here (e.g. configured via MAAS)
  #    but note that in this case a provider network must be
  #    configured as 'flat' not as 'VLAN' as there will
  #    be two 802.1q headers appended - one by the OVS itself and one
  #    by the kernel 802.1q module which will result in the lack of
  #    connectivity for no apparent reason.
  #    Note 2.2) This does not allow a dynamic addition of new provider networks
  #    with different VLANs.
  data-port:              &data-port              br-data:eth1
  bridge-mappings:        &bridge-mappings        physnet1:br-data
  flat-network-providers: &flat-network-providers ''
  vlan-ranges:            &vlan-ranges            physnet1

  # This is Management network, unrelated to OpenStack and other applications
  # OAM - Operations, Administration and Maintenance
  oam-space:           &oam-space           oam-space

  # This is OpenStack Admin network; for adminURL endpoints
  admin-space:         &admin-space         internal-space

  # This is OpenStack Public network; for publicURL endpoints
  public-space:        &public-space        public-space

  public-network-cidr: &public-network-cidr 10.244.8.0/24
  public-network-gateway: &public-network-gateway 10.244.8.1

  # DNS access space that should include DNS access VLANs separate
  # from public API VLANs, see lp:1804057
  dns-access-space:    &dns-access-space        oam-space

  # This is OpenStack Internal network; for internalURL endpoints
  internal-space:      &internal-space      internal-space

  # This is the overlay network
  overlay-space:       &overlay-space       internal-space

  # CEPH configuration
  # CEPH access network
  ceph-public-space:   &ceph-public-space   ceph-access-space

  # CEPH replication network
  ceph-cluster-space:  &ceph-cluster-space  ceph-replica-space

  # Workaround for 'only one default binding supported'
  oam-space-constr:    &oam-space-constr    spaces=oam-space
  ceph-access-constr:  &ceph-access-constr  spaces=ceph-access-space
  combi-access-constr:  &combi-access-constr  spaces=ceph-access-space,oam-space

  # CEPH OSD and journal devices; temporary workaround for #1674148
  osd-devices:         &osd-devices         /dev/disk/by-dname/bcache1
  osd-journal:         &osd-journal         /dev/nvme0n1

  # Customize-failure-domains is a dangerous option in the Ceph-MON and Ceph-OSD
  # charms. Never set this 'true' unless you have multiple zones configured in
  # MAAS which correlate to racks in the data center. Setting this option inappropriately
  # will result in a broken crush map but a valid Juju status which is both difficult
  # to diagnose and fix without a redeployment. #1764492
  customize-failure-domain:    &customize-failure-domain    True

  # Expected OSD count is total number of OSD disks that will be part of Ceph cluster.
  # Never set this number higher or much lower than the real number. 10-20% less than
  # actual number is acceptable
  expected-osd-count:  &expected-osd-count  6
  expected-mon-count:  &expected-mon-count  3

  # Baseline CPU model across the cloud.
  # On x86 the CPU model maps to a baseline CPUID mask, and the flags can be
  # used to then toggle bits in the mask on or off. When expanding nova-compute
  # services across a cloud that has multiple CPU models, it is required for
  # live-migration of VMs from newer cpu compute hosts to older cpu compute
  # hosts to determine and configure a baseline CPU model which will allow VMs
  # to migrate to any node in the cloud.
  # CPU model can be determined by executing
  # "virsh capabilities | awk '/<cpu>/,/<\/cpu>/' | awk '/<model>/,/<\/model>/'"
  # on each compute. Then, you'll need to find out a oldest CPU model in the
  # cloud by comparing outputs and replace the following config value with that.
  # For example, given "Broadwell-Server-IBRS" and "Skylake-Server-IBRS"
  # in the same cloud, Broadwell should be selected as a baseline.
  cpu-model:  &cpu-model  Haswell-noTSX-IBRS  # XXX: LP #1673547

  # DNS configuration
  # This configuration for overlay networks. Usually domain should be set to something
  # like "openstack.customername.lan." (notice . at the end), while cidr is for PTR
  # records, so in most cases 24 is just fine (16 is another option)
  dns-domain:   &dns-domain   "openstack.customername.lan."
  dns-cidr:     &dns-cidr     24

  # DNS servers should generally be the upstream corporate DNS servers or the Designate bind
  # servers depending on the scenario. See document "Neutron DNS and Designate Overview and
  # Best Practices" on Google Drive for more information. Using
  # Designate bind servers here require additional modifications (recursion, etc.) covered
  # in that document.
  dns-servers:   &dns-servers   10.244.32.1

  # nagios-context should be bootstack-customerA-locationB-cloudname
  nagios-context: &nagios-context FCE_TEMPLATE

  ephemeral-device:    &ephemeral-device    /dev/disk/by-dname/bcache-nova-ephemeral

  # Octavia loadbalancer image cloud archive series
  retrofit-uca-pocket:   &retrofit-uca-pocket stein

  # Octavia management certs
  # These should be specified relative to the bundle with include-base64
  # ex: include-base64://../certs/controller_ca.pem
  lb-mgmt-issuing-cacert:             &lb-mgmt-issuing-cacert              include-base64://../ssl/octavia/controller_ca.pem
  lb-mgmt-issuing-ca-private-key:     &lb-mgmt-issuing-ca-private-key      include-base64://../ssl/octavia/controller_ca_key.pem
  lb-mgmt-issuing-ca-key-passphrase:  &lb-mgmt-issuing-ca-key-passphrase   foobar
  lb-mgmt-controller-cacert:          &lb-mgmt-controller-cacert           include-base64://../ssl/octavia/controller_ca.pem
  lb-mgmt-controller-cert:            &lb-mgmt-controller-cert             include-base64://../ssl/octavia/controller_cert_bundle.pem


  # Various VIPs
  aodh-vip:            &aodh-vip            "10.244.8.200 192.168.33.130"
  ceilometer-vip:      &ceilometer-vip      "10.244.8.201 192.168.33.131"
  cinder-vip:          &cinder-vip          "10.244.8.202 192.168.33.132"
  dashboard-vip:       &dashboard-vip       "10.244.8.203"
  designate-vip:       &designate-vip       "10.244.8.204 192.168.33.133"
  glance-vip:          &glance-vip          "10.244.8.205 192.168.33.134"
  gnocchi-vip:         &gnocchi-vip         "10.244.8.206 192.168.33.135"
  heat-vip:            &heat-vip            "10.244.8.207 192.168.33.136"
  keystone-vip:        &keystone-vip        "10.244.8.208 192.168.33.137"
  mysql-vip:           &mysql-vip           "192.168.33.138"
  neutron-api-vip:     &neutron-api-vip     "10.244.8.209 192.168.33.139"
  nova-cc-vip:         &nova-cc-vip         "10.244.8.210 192.168.33.140"
  rados-gateway-vip:   &rados-gateway-vip   "10.244.8.211 192.168.33.141"
  vault-vip:           &vault-vip           "192.168.33.142"

  # NTP configuration
  ntp-source:          &ntp-source          "ntp.ubuntu.com"

  # designate nameservers
  designate-nameservers: &designate-nameservers "ns1.example.com."

machines:
  # KVMs
  "0":
    constraints: tags=nagios
    series: bionic
  "1":
    constraints: tags=grafana
    series: bionic
  "9":
    constraints: tags=prometheus
    series: bionic
  "10":
    constraints: tags=graylog
    series: bionic
  "15":
    constraints: tags=vault
  "16":
    constraints: tags=vault
  "17":
    constraints: tags=vault
  "18":
    constraints: tags=elastic
  "19":
    constraints: tags=graylog
    series: bionic
  "20":
    constraints: tags=graylog
    series: bionic

  # Baremetals
  "1000":
    constraints: tags=foundation-nodes
  "1001":
    constraints: tags=foundation-nodes
  "1002":
    constraints: tags=foundation-nodes
  "1003":
    constraints: tags=foundation-nodes
  "1004":
    constraints: tags=foundation-nodes
  "1005":
    constraints: tags=foundation-nodes

applications:
  # HAcluster
  hacluster-aodh:
    charm: cs:hacluster
  hacluster-cinder:
    charm: cs:hacluster
  hacluster-glance:
    charm: cs:hacluster
  hacluster-gnocchi:
    charm: cs:hacluster
  hacluster-horizon:
    charm: cs:hacluster
  hacluster-keystone:
    charm: cs:hacluster
  hacluster-neutron:
    charm: cs:hacluster
  hacluster-nova:
    charm: cs:hacluster
  hacluster-mysql:
    charm: cs:hacluster
  hacluster-radosgw:
    charm: cs:hacluster
  hacluster-designate:
    charm: cs:hacluster
  hacluster-heat:
    charm: cs:hacluster
  hacluster-ceilometer:
    charm: cs:hacluster
  hacluster-vault:
    charm: cs:hacluster
  # Ceph
  ceph-mon:
    charm: cs:ceph-mon
    num_units: 3
    bindings:
      "": *oam-space
      public: *ceph-public-space
      osd: *ceph-public-space
      client: *ceph-public-space
      admin: *ceph-public-space
      cluster: *ceph-cluster-space
    options:
      expected-osd-count: *expected-osd-count
      source: *openstack-origin
      monitor-count: *expected-mon-count
      customize-failure-domain: *customize-failure-domain
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  ceph-osd:
    charm: cs:ceph-osd
    num_units: 6
    bindings:
      "": *oam-space
      public: *ceph-public-space
      cluster: *ceph-cluster-space
      secrets-storage: *internal-space
      mon: *ceph-public-space
    options:
      osd-devices: *osd-devices
      osd-journal: *osd-journal
      source: *openstack-origin
      customize-failure-domain: *customize-failure-domain
      autotune: false
      aa-profile-mode: complain
      bluestore: true
      osd-encrypt: true
      osd-encrypt-keymanager: vault
    to:
    - '1000'
    - '1001'
    - '1002'
    - '1003'
    - '1004'
    - '1005'
  ceph-radosgw:
    charm: cs:ceph-radosgw
    num_units: 3
    constraints: *combi-access-constr
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      mon: *ceph-public-space
    options:
      source: *openstack-origin
      vip: *rados-gateway-vip
      region: *openstack-region
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  # OpenStack
  aodh:
    charm: cs:aodh
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      region: *openstack-region
      vip: *aodh-vip
      use-internal-endpoints: True
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  gnocchi:
    charm: cs:gnocchi
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
      storage-ceph: *ceph-public-space
      coordinator-memcached: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      region: *openstack-region
      vip: *gnocchi-vip
      use-internal-endpoints: True
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  cinder:
    charm: cs:cinder
    num_units: 3
    constraints: *combi-access-constr
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      block-device: None
      glance-api-version: 2
      vip: *cinder-vip
      use-internal-endpoints: True
      region: *openstack-region
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  cinder-ceph:
    charm: cs:cinder-ceph
    num_units: 0
    options:
      restrict-ceph-pools: False
  glance:
    charm: cs:glance
    constraints: *combi-access-constr
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      vip: *glance-vip
      use-internal-endpoints: True
      restrict-ceph-pools: False
      region: *openstack-region
    num_units: 3
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  keystone:
    charm: cs:keystone
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      vip: *keystone-vip
      region: *openstack-region
      preferred-api-version: 3
      token-provider: 'fernet'
      # override default token timeout to 24hr (86400 seconds) to address
      # LP: #1856876 namnely to fix long-running live migration issues and
      # horizon re-auth.
      token-expiration: 86400
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  keystone-ldap:
    charm: cs:keystone-ldap
    num_units: 0
    options:
      debug: true
      domain-name: cdoqa
      use-internal-endpoints: true
      ldap-config-flags: "{ user_tree_dn: 'ou=users,dc=test,dc=com', user_objectclass: posixAccount, user_id_attribute: uidNumber, user_name_attribute: uid, group_tree_dn: 'ou=groups,dc=test,dc=com', group_objectclass: posixGroup, group_id_attribute: gidNumber, group_name_attribute: cn, group_member_attribute: memberUid, group_members_are_ids: True}"
      ldap-readonly: true
      ldap-password: "crapper"
      ldap-server: "ldap://10.245.221.126:389"
      ldap-suffix: "dc=test,dc=com"
      ldap-user: "cn=admin,dc=test,dc=com"
  logrotate:
    charm: cs:~logrotate-charmers/logrotate-charm
    num_units: 0
    options:
      logrotate-retention: 60
  mysql:
    charm: cs:percona-cluster
    num_units: 3
    bindings:
      "": *oam-space
      cluster: *internal-space
      shared-db: *internal-space
      ha: *internal-space
      db: *internal-space
      db-admin: *internal-space
    options:
      source: *openstack-origin
      innodb-buffer-pool-size: *mysql-innodb-buffer-pool-size
      vip: *mysql-vip
      #root-password: password
      #sst-password: password
      wait-timeout: *mysql-wait-timeout
      min-cluster-size: 3
      enable-binlogs: True
      performance-schema: True
      max-connections: *mysql-connections
      tuning-level: *mysql-tuning-level
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  neutron-api:
    charm: cs:neutron-api
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      region: *openstack-region
      # configure physical-network-mtus for every physnet mentioned in
      # ***flat-network-providers***
      flat-network-providers: *flat-network-providers
      # configure physical-network-mtus for every physnet mentioned in
      # ***vlan-ranges***
      # When provider networks are used directly, Designate-generated
      # records will only be created for vlans ***outside*** the range
      # specified in this option
      # <physnet-name>:<vlan_min>:<vlan_max>
      vlan-ranges: *vlan-ranges
      neutron-security-groups: True
      overlay-network-type: vxlan gre
      use-internal-endpoints: True
      vip: *neutron-api-vip
      enable-l3ha: True
      dhcp-agents-per-network: 2
      enable-ml2-port-security: True
      default-tenant-network-type: vxlan
      l2-population: True
      enable-ml2-dns: True
      dns-domain: *dns-domain
      reverse-dns-lookup: True
      ipv4-ptr-zone-prefix-size: *dns-cidr
      # set MTU settings to achieve 1500 MTU on instance interfaces in
      # the overlay network. This will only work provided that the VTEP
      # VLANs (overlay-space) are configured to have MTU larger than
      # 1550 (jumbo frames) which is documented in the prerequisites doc
      # Note: The internal net in the solutions-qa lab is used as the
      # underlay network, and it is configured for 1500 MTU, not 1550.
      global-physnet-mtu: 1500
      path-mtu: 1500
      # Space-delimited list of <physical_network>:<mtu> pairs specifying
      # MTU for individual physical networks
      # i.e: dcfabric:1500
      physical-network-mtus: physnet1:1500
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  neutron-gateway:
    charm: cs:neutron-gateway
    num_units: 2
    bindings:
      "": *oam-space
      data: *overlay-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      bridge-mappings: *bridge-mappings
      data-port: *data-port
      aa-profile-mode: enforce
      dns-servers: *dns-servers
      customize-failure-domain: *customize-failure-domain
    to:
    - 1004
    - 1005
  neutron-openvswitch:
    charm: cs:neutron-openvswitch
    num_units: 0
    bindings:
      # XXX: review bindings
      "": *oam-space
      data: *overlay-space
    options:
      worker-multiplier: *worker-multiplier
      bridge-mappings: *bridge-mappings
      prevent-arp-spoofing: True
      firewall-driver: openvswitch
      dns-servers: *dns-servers
  nova-cloud-controller:
    charm: cs:nova-cloud-controller
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
      memcache: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      network-manager: Neutron
      region: *openstack-region
      vip: *nova-cc-vip
      console-access-protocol: spice
      console-proxy-ip: local
      use-internal-endpoints: True
      cpu-allocation-ratio: *cpu-allocation-ratio
      ram-allocation-ratio: *ram-allocation-ratio
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  nova-compute-kvm:
    charm: cs:nova-compute
    num_units: 4
    bindings:
      "": *oam-space
      internal: *internal-space
      secrets-storage: *internal-space
    options:
      openstack-origin: *openstack-origin
      enable-live-migration: True
      enable-resize: True
      migration-auth-type: ssh
      use-internal-endpoints: True
      libvirt-image-backend: qcow2
      restrict-ceph-pools: False
      aa-profile-mode: enforce
      virt-type: kvm
      customize-failure-domain: *customize-failure-domain
      reserved-host-memory: *reserved-host-memory
      worker-multiplier: *worker-multiplier
      encrypt: true
      ephemeral-device: *ephemeral-device
      cpu-mode: custom
      cpu-model: *cpu-model
    to:
    - 1000
    - 1001
    - 1002
    - 1003
  ntp:
    charm: cs:ntp
    num_units: 0
    options:
      source: *ntp-source
  openstack-dashboard:
    charm: cs:openstack-dashboard
    num_units: 3
    constraints: *oam-space-constr
    bindings:
      "": *public-space
      shared-db: *internal-space
    options:
      openstack-origin: *openstack-origin
      webroot: "/"
      secret: "encryptcookieswithme"
      vip: *dashboard-vip
      neutron-network-l3ha: True
      neutron-network-lb: True
      neutron-network-firewall: False
      cinder-backup: False
      password-retrieve: True
      endpoint-type: publicURL
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  rabbitmq-server:
    charm: cs:rabbitmq-server
    bindings:
      "": *oam-space
      amqp: *internal-space
      cluster: *internal-space
    options:
      source: *openstack-origin
      min-cluster-size: 3
    num_units: 3
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  heat:
    charm: cs:heat
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
      openstack-origin: *openstack-origin
      region: *openstack-region
      vip: *heat-vip
      use-internal-endpoints: True
    to:
    - lxd:1000
    - lxd:1001
    - lxd:1002
  designate:
    charm: cs:designate
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
      dns-backend: *internal-space
      coordinator-memcached: *internal-space
    options:
      openstack-origin: *openstack-origin
      region: *openstack-region
      vip: *designate-vip
      use-internal-endpoints: True
      nameservers: *designate-nameservers
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  designate-bind:
    charm: cs:designate-bind
    num_units: 2
    constraints: *oam-space-constr
    bindings:
      "": *internal-space
      # DNS port 53 access for external clients and tenants via provider networks
      dns-backend: *internal-space
      dns-frontend: *dns-access-space
    options:
      use-internal-endpoints: True
      # By default, only names in zones managed by Designate are resolved.
      # Enable recursion and forwarders to resolve names outside of Designate,
      # such as google.com or archive.ubuntu.com
      # Recursion and forwarders should be enabled with extra care. Otherwise,
      # the DNS server may be open for anyone, which could be used for some
      # attacks as an open resolver. Set ACLs with allowed_nets and/or
      # allowed_recursion_nets.  Allowed_recursion_nets is only set when
      # recursion and forwarder access needs to be controlled separately.
      # An example of the allowed_nets list would be:
      # "Tenant CIDR;Provider network CIDR" ("172.16.0.0/24;10.244.33.0/21")
      # allowed_recursion_nets: FCE_TEMPLATE
      allowed_nets: "172.16.0.0/24;10.0.0.0/8"
      forwarders: "10.245.208.49"
      recursion: True
      disable-dnssec-validation: True
    to:
    - lxd:1001
    - lxd:1002
  memcached:
    charm: cs:memcached
    num_units: 2
    constraints: *oam-space-constr
    bindings:
      "": *internal-space
      cache: *internal-space
    options:
      allow-ufw-ip6-softfail: True
    to:
    - designate-bind/0
    - designate-bind/1
  ceilometer:
    charm: cs:ceilometer
    num_units: 3
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
    options:
      openstack-origin: *openstack-origin
      region: *openstack-region
      vip: *ceilometer-vip
      use-internal-endpoints: True
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  ceilometer-agent:
    charm: cs:ceilometer-agent
    num_units: 0
    options:
      use-internal-endpoints: True
  bcache-tuning:
    charm: cs:bcache-tuning
    num_units: 0
  # XXX: LP: #1829150 - since juju won't setup additional
  # routes from MAAS, we have to use this policy-routing
  # charm to configure the gateway for the public network.
  public-policy-routing:
    charm: cs:~canonical-bootstack/policy-routing
    options:
      cidr: *public-network-cidr
      gateway: *public-network-gateway
  graylog:
    charm: cs:graylog   # XXX: may hit bug 1846364
    series: bionic
    bindings:
      "": *oam-space
    num_units: 3
    options:
      channel: 3/stable
      jvm_heap_size: 8G
    to:
    - 10
    - 19
    - 20
  graylog-mongodb:
    charm: cs:mongodb
    bindings:
      "": *oam-space
    num_units: 3
    options:
      nagios_context: *nagios-context
    to:
    - lxd:10
    - lxd:19
    - lxd:20
  elasticsearch:
    charm: cs:elasticsearch
    bindings:
      "": *oam-space
    num_units: 1
    options:
      firewall_enabled: False
      # If behind a firewall, specify the key/path to key here.
      # apt-key-url: FCE_TEMPLATE
      es-heap-size: 1
      gpg-key: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        Version: SKS 1.1.6
        Comment: Hostname: keyserver.ubuntu.com

        mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBDA+bGFOwy
        hbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9CUliQe324qvObU2Q
        RtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZj3SF1SPO+TB5QrHkrQHBsmX+
        Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj
        1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEB
        AAG0RUVsYXN0aWNzZWFyY2ggKEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3Bz
        QGVsYXN0aWNzZWFyY2gub3JnPokBOAQTAQIAIgUCUjceygIbAwYLCQgHAwIGFQgCCQoLBBYC
        AwECHgECF4AACgkQ0n1mbNiOQrRzjAgAlTUQ1mgo3nK6BGXbj4XAJvuZDG0HILiUt+pPnz75
        nsf0NWhqR4yGFlmpuctgCmTD+HzYtV9fp9qW/bwVuJCNtKXk3sdzYABY+Yl0Cez/7C2GuGCO
        lbn0luCNT9BxJnh4mC9h/cKI3y5jvZ7wavwe41teqG14V+EoFSn3NPKmTxcDTFrV7SmVPxCB
        cQze00cJhprKxkuZMPPVqpBS+JfDQtzUQD/LSFfhHj9eD+Xe8d7sw+XvxB2aN4gnTlRzjL1n
        TRp0h2/IOGkqYfIG9rWmSLNlxhB2t+c0RsjdGM4/eRlPWylFbVMc5pmDpItrkWSnzBfkmXL3
        vO2X3WvwmSFiQbkBDQRSNx7KAQgA5JUlzcMW5/cuyZR8alSacKqhSbvoSqqbzHKcUQZmlzNM
        KGTABFG1yRx9r+wa/fvqP6OTRzRDvVS/cycws8YX7Ddum7x8uI95b9ye1/Xy5noPEm8cD+hp
        lnpU+PBQZJ5XJ2I+1l9Nixx47wPGXeClLqcdn0ayd+v+Rwf3/XUJrvccG2YZUiQ4jWZkoxsA
        07xx7Bj+Lt8/FKG7sHRFvePFU0ZS6JFx9GJqjSBbHRRkam+4emW3uWgVfZxuwcUCn1ayNgRt
        KiFv9jQrg2TIWEvzYx9tywTCxc+FFMWAlbCzi+m4WD+QUWWfDQ009U/WM0ks0KwwEwSk/UDu
        ToxGnKU2dQARAQABiQEfBBgBAgAJBQJSNx7KAhsMAAoJENJ9ZmzYjkK0c3MIAIE9hAR20mqJ
        WLcsxLtrRs6uNF1VrpB+4n/55QU7oxA1iVBO6IFu4qgsF12JTavnJ5MLaETlggXY+zDef9sy
        TPXoQctpzcaNVDmedwo1SiL03uMoblOvWpMR/Y0j6rm7IgrMWUDXDPvoPGjMl2q1iTeyHkMZ
        EyUJ8SKsaHh4jV9wp9KmC8C+9CwMukL7vM5w8cgvJoAwsp3Fn59AxWthN3XJYcnMfStkIuWg
        R7U2r+a210W6vnUxU4oN0PmMcursYPyeV0NX/KQeUeNMwGTFB6QHS/anRaGQewijkrYYoTNt
        fllxIu9XYmiBERQ/qPDlGRlOgVTd9xUfHFkzB52c70E=
        =92oX
        -----END PGP PUBLIC KEY BLOCK-----
    to:
    - 18
  filebeat:
    charm: cs:filebeat
    options:
      logpath: "/var/log/*.log /var/log/*/*.log /var/log/syslog"
      install_keys: |-
        - |
          -----BEGIN PGP PUBLIC KEY BLOCK-----
          Version: SKS 1.1.6
          Comment: Hostname: keyserver.ubuntu.com

          mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBDA+bGFOwy
          hbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9CUliQe324qvObU2Q
          RtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZj3SF1SPO+TB5QrHkrQHBsmX+
          Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj
          1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEB
          AAG0RUVsYXN0aWNzZWFyY2ggKEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3Bz
          QGVsYXN0aWNzZWFyY2gub3JnPokBOAQTAQIAIgUCUjceygIbAwYLCQgHAwIGFQgCCQoLBBYC
          AwECHgECF4AACgkQ0n1mbNiOQrRzjAgAlTUQ1mgo3nK6BGXbj4XAJvuZDG0HILiUt+pPnz75
          nsf0NWhqR4yGFlmpuctgCmTD+HzYtV9fp9qW/bwVuJCNtKXk3sdzYABY+Yl0Cez/7C2GuGCO
          lbn0luCNT9BxJnh4mC9h/cKI3y5jvZ7wavwe41teqG14V+EoFSn3NPKmTxcDTFrV7SmVPxCB
          cQze00cJhprKxkuZMPPVqpBS+JfDQtzUQD/LSFfhHj9eD+Xe8d7sw+XvxB2aN4gnTlRzjL1n
          TRp0h2/IOGkqYfIG9rWmSLNlxhB2t+c0RsjdGM4/eRlPWylFbVMc5pmDpItrkWSnzBfkmXL3
          vO2X3WvwmSFiQbkBDQRSNx7KAQgA5JUlzcMW5/cuyZR8alSacKqhSbvoSqqbzHKcUQZmlzNM
          KGTABFG1yRx9r+wa/fvqP6OTRzRDvVS/cycws8YX7Ddum7x8uI95b9ye1/Xy5noPEm8cD+hp
          lnpU+PBQZJ5XJ2I+1l9Nixx47wPGXeClLqcdn0ayd+v+Rwf3/XUJrvccG2YZUiQ4jWZkoxsA
          07xx7Bj+Lt8/FKG7sHRFvePFU0ZS6JFx9GJqjSBbHRRkam+4emW3uWgVfZxuwcUCn1ayNgRt
          KiFv9jQrg2TIWEvzYx9tywTCxc+FFMWAlbCzi+m4WD+QUWWfDQ009U/WM0ks0KwwEwSk/UDu
          ToxGnKU2dQARAQABiQEfBBgBAgAJBQJSNx7KAhsMAAoJENJ9ZmzYjkK0c3MIAIE9hAR20mqJ
          WLcsxLtrRs6uNF1VrpB+4n/55QU7oxA1iVBO6IFu4qgsF12JTavnJ5MLaETlggXY+zDef9sy
          TPXoQctpzcaNVDmedwo1SiL03uMoblOvWpMR/Y0j6rm7IgrMWUDXDPvoPGjMl2q1iTeyHkMZ
          EyUJ8SKsaHh4jV9wp9KmC8C+9CwMukL7vM5w8cgvJoAwsp3Fn59AxWthN3XJYcnMfStkIuWg
          R7U2r+a210W6vnUxU4oN0PmMcursYPyeV0NX/KQeUeNMwGTFB6QHS/anRaGQewijkrYYoTNt
          fllxIu9XYmiBERQ/qPDlGRlOgVTd9xUfHFkzB52c70E=
          =92oX
          -----END PGP PUBLIC KEY BLOCK-----
      install_sources: |
          - 'deb https://artifacts.elastic.co/packages/5.x/apt stable main'
  nagios:
    charm: cs:nagios
    series: bionic
    bindings:
      "": *oam-space
    num_units: 1
    options:
    # enable_livestatus: true  XXX: bug 1819537
      nagios_host_context: *nagios-context
    to:
    - 0
  openstack-service-checks:
    charm: cs:~canonical-bootstack/openstack-service-checks
    constraints: *oam-space-constr
    bindings:
      "": *public-space
      identity-credentials: *internal-space
    num_units: 1
    to:
    - lxd:1000
  nrpe-host:
    charm: cs:nrpe
    bindings:
      monitors: *oam-space
    options:
      nagios_hostname_type: "host"
      nagios_host_context: *nagios-context
      xfs_errors: "30"
  nrpe-container:
    charm: cs:nrpe
    bindings:
      monitors: *oam-space
    options:
      nagios_hostname_type: unit
      nagios_host_context: *nagios-context
      disk_root: ''
      load: ''
      swap: ''
      swap_activity: ''
      mem: ''
  landscape-client:
    charm: cs:landscape-client
    options:
      disable-unattended-upgrades: True
      account-name: "standalone"
      origin: |
        deb http://ppa.launchpad.net/landscape/18.03/ubuntu bionic main|-----BEGIN PGP PUBLIC KEY BLOCK-----
        Version: SKS 1.1.6
        Comment: Hostname: keyserver.ubuntu.com

        mI0ESXN/egEEAOgRYISU9dnQm4BB5ZEEwKT+NKUDNd/DhMYdtBMw9Yk7S5cyoqpbtwoPJVzK
        AXxq+ng5e3yYypSv98pLMr5UF09FGaeyGlD4s1uaVFWkFCO4jsTg7pWIY6qzO/jMxB5+Yu/G
        0GjWQMNKxFk0oHMa0PhNBZtdPacVz65mOVmCsh/lABEBAAG0G0xhdW5jaHBhZCBQUEEgZm9y
        IExhbmRzY2FwZYi2BBMBAgAgBQJJc396AhsDBgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQ
        boWobkZStOb+rwP+ONKUWeX+MTIPqGWkknBPV7jm8nyyIUojC4IhS+9YR6GYnn0hMABSkEHm
        IV73feKmrT2GESYI1UdYeKiOkWsPN/JyBk+eTvKet0qsw5TluqiHSW+LEi/+zUyrS3dDMX3o
        yaLgYa+UkjIyxnaKLkQuCiS+D+fYwnJulIkhaKObtdE=
        =UwRd
        -----END PGP PUBLIC KEY BLOCK-----
      registration-key: FCE_TEMPLATE
      url: https://landcapeha-1.maas/message-system
      ping-url: https://landscapeha-1.maas/ping
      ssl-public-key: |
        base64:LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXBPZ0F3SUJBZ0lV
        TzdRM1Y4QmNBbGx2VVlJVTB3RHo0NUVOOThJd0RRWUpLb1pJaHZjTkFRRUwKQlFB
        d1pURUxNQWtHQTFVRUJoTUNRVlV4RVRBUEJnTlZCQWdNQ0VOdmJHOXlZV1J2TVJR
        d0VnWURWUVFLREF0VApiMngxZEdsdmJuTlJRVEV0TUNzR0ExVUVBd3drYkdGdVpI
        TmpZWEJsYUdFdE1TNXdjbTlrZFdOMGFXOXVMbk52CmJIVjBhVzl1YzNGaE1CNFhE
        VEU1TURnek1ERTBOVGswTmxvWERUSTVNRGd5TnpFME5UazBObG93WlRFTE1Ba0cK
        QTFVRUJoTUNRVlV4RVRBUEJnTlZCQWdNQ0VOdmJHOXlZV1J2TVJRd0VnWURWUVFL
        REF0VGIyeDFkR2x2Ym5OUgpRVEV0TUNzR0ExVUVBd3drYkdGdVpITmpZWEJsYUdF
        dE1TNXdjbTlrZFdOMGFXOXVMbk52YkhWMGFXOXVjM0ZoCk1JSUJJakFOQmdrcWhr
        aUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBMi95dkkzVkN5WUMxd1JTRUFo
        M2sKckc1V0FnV0FKNFd4OXROeXllWTF5Z2JKR3RKZzRIOHJXT2RKM0wwVW8xcEhI
        S281ZWlLSWNtR0s2SmtZSVpraAo1aUF4UFplU2VMMjJTdUNUNGdXcllNTHB1bFBM
        dkxLUUlGV0pMRlF3WnNUSFZwNUc3NEw0cURSaUd4Z2dYaDZaCmpjekJoUkR1UndF
        SWsrNVVEUW9GdkhUaGVRNU5jRXM0Q3ZhVVYrcTRiSXB6OU5xU3hHZmNkVFBJV1hO
        dTEyNVMKWkIwV1ZULzNCeTVac1BzTzVlNHJjVHZYVGxlRWk1aEhCZURQZkNKZERz
        Q2k5Y2lVd2tnQTdqQUlsdmw5dXBxbAprNUlsRjZSRkVsZGpUL0x4VVpjblBBNTRi
        bnRzSmlqaGVCOEZaNlQ2VTFuVStES0tUL2Vrck1FN2RrQkVVOGxiClh3SURBUUFC
        bzFNd1VUQWRCZ05WSFE0RUZnUVV6T0hPbDhuMThhM3dDUkNaaFYyc28yeXpwa0l3
        SHdZRFZSMGoKQkJnd0ZvQVV6T0hPbDhuMThhM3dDUkNaaFYyc28yeXpwa0l3RHdZ
        RFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcQpoa2lHOXcwQkFRc0ZBQU9DQVFFQUd4
        YzFqVlA4VkVvTC8rL2FrK2UvdnJwanFkSWFXZ0w4c1RZbktQRzBXNXhlCkI4Vkpx
        c256U2ZrSDBsaGJUMDRRcXJCU1N0YVI4djNLS28yNlJ3ZVVNQzVpS1l3dEQ1ZmVx
        Z0NBUjhSQnVrd3YKUWMxd3hKV1hyKzFhZXloSGpXOFVWQWFuWWxhbkVwWHA3ZWV4
        amZ3ZW4vWUtFcEhiNUxycHNVLzNVVVZEOVcwYgo3RWlURkJFdVdOUk1PN2I5cEdD
        TTk5NWh2MzA5dDM1SlFGdzFxN2RwaTcrTEJKMWNRVEtGdGg0czFHellid1VJCjBY
        aEZkMXlVVVF2akw2bnFNWGgyTjlGNDg2YUdTWlVCaW10VGp5UHNoQjFqTjRMYXox
        d2U4VFVKRk9PTnlaeUkKY1NlM3ZFV0FwelF2aGIvTzB2NUhaMmZLUmd5VjJla3hH
        TUlFTHpjNlBBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  prometheus:
    charm: cs:prometheus2
    series: bionic
    bindings:
      "": *oam-space
    num_units: 1
    to:
    - 9
  prometheus-openstack-exporter:
    charm: cs:prometheus-openstack-exporter
    constraints: *oam-space-constr
    bindings:
      "": *public-space
      identity-credentials: *internal-space
      prometheus-openstack-exporter-service: *oam-space
    options:
      cpu-allocation-ratio: *cpu-allocation-ratio
      ram-allocation-ratio: *ram-allocation-ratio
    num_units: 1
    to:
    - lxd:1002
  grafana:
    charm: cs:~prometheus-charmers/grafana
    series: bionic
    bindings:
      "": *oam-space
    options:
      port: "3000"  # XXX: bug 1752960
      install_method: snap
    num_units: 1
    to:
    - 1
  telegraf:
    charm: cs:telegraf
    options:
      install_sources: |
        - 'deb http://ppa.launchpad.net/telegraf-devs/ppa/ubuntu bionic main'
      install_keys: |-
        - |
          -----BEGIN PGP PUBLIC KEY BLOCK-----
          Version: SKS 1.1.6
          Comment: Hostname: keyserver.ubuntu.com

          mQINBFcVSuIBEAC80aj0tAQ6+NhGV/bkSwu6Oj+BpDR50Be3uBv7ttdtvChL5zHTnaxjdK3h
          LKSyrDLlmSOkffQ2uO7CxvqeF09MsHhyvrDDx0EY54//xxoAB++PoB2OQqmqldg3Al5Hp4Dz
          rllV5CIX5PD8NGX8UpO3HXk5wEwn9G81l8cia3vPveU82EIkHMiJGpk6+L86OMlwXzxkSI3M
          xXgNFKQc+ELDYLvGSseYC9vPN3kdmFoo/UjznPPE4fxr4bXit3N8Abl1jYjBa0x6SWkK1BAb
          s8w3BXtvyk90z9Oyme69wPD4zAYfFp+kN2nDmTDBMtNCyMu9oatdI5SukMNK4Lcm8eAE6VNs
          04j7BKvGk9+17M8WP9Pw8nIisOwScS9gUlJlLUpnBaJ+sxoOvGQ4mzZxYMKzJh0E58aEX3bS
          AyzQfsae8bZLNOTcgotyzzIDJFF9npzu3wmKjeOt/706p4LiDqKUbQK6cI+QcJ/y80ZUK8pB
          M043ttSHWLmTBFX2drp6zQGae9+02fX89ZD+5c+MPlubJMYCCKkvQT4OssHfC+dVDQ66rwUy
          OObrzsVgikdpIxQVitL3J+Dms56xAkdFfoo+qdxxdv9S/eakc5mfavc/4WVvmFDaJiqJnJRR
          Ryw1zApRtuweEEdVn8niy1mahoKpWaw1pTI4AazjWI6xJH1JyQARAQABtB9MYXVuY2hwYWQg
          UFBBIGZvciBUZWxlZ3JhZiBEZXZziQI4BBMBAgAiBQJXFUriAhsDBgsJCAcDAgYVCAIJCgsE
          FgIDAQIeAQIXgAAKCRDxDL4ByUQG9UgbEACa4IzdeYxH/S5I6MrZfvWNo/JTZ/MZWDD+QlMW
          60ThAemCUSE+NJvZZ1q7ovGFpYnHJT9GQXOwJAX1quDUqyM1uXNmLlOyIVNnmjUTINoLhw2V
          iC8E7dMWC9w4Na2fKezmNHH00kNl43ncstIjjZ3pLnDGYm1y0ItiCUcTRgHhx2cUZ/vStz1S
          Pdqj4P3i8vuspoYJ2T3VPlM/0G+u9Yjuy3Uzu9RugOyO3UJPoi3+4O2VTNosSBy5MILVCp49
          eigyFVGpq5sT/c86qd1zqmsNWEubrlzDfETS4LMj9epr46ZKPXGQkeryt1m2Oe0HkIdNZ+IQ
          5p+i9fnEy7/1uKTXWQYsg2UWsLA2PvTvwY8JxxMhUFgv12q2w7STntqJyi9PLItYNtbtKoS3
          XZCCMqQLCWMXHY+2ol6rRSfs06H/wzlR8LjDaEXkDVuDmqMtcbgTboZYblsGxst7I/Y4Wgfi
          J52uiIyobQ69uJbG0XeRTLZ3WyrBkopEsTX/+sQjVqbADXYU4hBVDgnCf2uN/5dcwSEvDj8/
          +WsToAfEJkscRBsQjTLVzf+eFqHLrbqz/yoYIqBc//IJMBSbxIf5mrOHHLdbOuMCB6PVwpTI
          vLFOSDNPuVDX+S1goA8KJTnXpm8jWDynn3XaXx3AlYw4iZ0ETSgQLQLRd6JuPOEGXsGdBA==
          =ufaX
          -----END PGP PUBLIC KEY BLOCK-----
    bindings:
      # overrides private-address exposed to prometheus
      prometheus-client: *oam-space
  telegraf-prometheus:
    charm: cs:telegraf
    bindings:
      # overrides private-address exposed to prometheus
      prometheus-client: *oam-space
  lldpd:
    charm: cs:lldpd
    options:
      interfaces-regex: 'en*'
  canonical-livepatch:
    charm: cs:canonical-livepatch
    options:
      livepatch_key: include-file:///home/ubuntu/solutions-qa-ci/credencials/livepatch-key
  thruk-agent:
    charm: cs:thruk-agent
    series: bionic
    options:
      source: 'deb http://ppa.launchpad.net/canonical-bootstack/thruk/ubuntu bionic main'
      key: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        Version: SKS 1.1.6
        Comment: Hostname: keyserver.ubuntu.com

        mQINBFQSRaQBEADDAtFnmi0w6ddIoR5olNu2778ACItGLtLPmlKTHJUjbs26nLZQcp5OY2DR
        cE03k55eXy7mn1aSxQaIqbC6lSPzpy+d1RTXMJmIJcEuyJKmJ2XfS9TgdhS3hrYmmNuFnBqp
        xc8FAqDnD/BnlF1suhgLf0mxiEZaTev5/ps3f/Ma8RK5ev5rM3ou/8iLewXlXBH83lf2OnzV
        BuYeAc/ikAnSg7dxyI26RMqdPi60NC67AVYqEddg8XoJ7zppUkvH4F+SlbgeadwEj6tjsOO3
        S/CII9AuSyUbkxm10HHKh3WiKgd8sUWmOvMwTow7NkThlydzDiyIS+WBCfoMWdogqTER+7wX
        tfpR4Bo84ZJAx9ksi8YBidx1gCn6jgebkB4xeel7BTwoIAZL+ShWyYRCSo++DQneE4LkhPr8
        8V2+/VQbkXWIcyNagEA8mTJtkXgk3Pjalumt2TyR95/pxodN1+bVd2scoT4OMlAtKTZISwXs
        evYNo8Z6/ymFuSmtqYGGKA11vpao/OJfF4dvVkdArQ1gxgxhFnZyekZlwD81uC6hT/aTqiz6
        9nSYvVZsnQJcPE2hjEZ+Fk3x/A3NGGQrorICRFuoLzjTFAoeOnhdTaMIQzwXg4bdYCNv4j8P
        PJkvF8EPi1lgcOZ1k1Ng4DRSu1EkHGs3i50h4nyVScKEaaDtRwARAQABtCVMYXVuY2hwYWQg
        UFBBIGZvciBDYW5vbmljYWwgQm9vdHN0YWNriQI4BBMBAgAiBQJUEkWkAhsDBgsJCAcDAgYV
        CAIJCgsEFgIDAQIeAQIXgAAKCRBLmoF0eiB1QuDOD/wLwZrtJOSm1W7Gkm5Qj5djkXi7b8mc
        M4vS2fbxdZJjE+KRqxOHGdK68CT8RyUCfl13+RLyA45UxsNSoGmdnTcc7LUJbihxy92WgzF5
        saJ1ObTMge/avS8kJ7l1B0xS3hue5GXfyVYcYlXV6gD53Kfu03z619PE2rmukm1YtyRWPQho
        okr4kNIJbAqG8LR0GnF0CKt9oq5bIs06LvBm2cbFa9txeDOZcLMKfgMOda3Ju7U6k56MYl4a
        sUUP8oXehcvbLx9nsOT4A4XHLj+yOTuXGsTXvn+M6NXODuHj3cN0OvVN+o6/6kjyVuWJqONr
        IdJ5knIWx6UKoWXzRdcqbsSyDpyuUjOFAPyQdQ3zs1DL9vJbOUasQOilR+YVX+ULN9Q17GkK
        IwZc68b9bDZQRtJi2bOhorWamHKZuEKw95lCEHOms/C4Lw04y7sPnXV0MZejXfn/X4N5BELb
        ItSPhoe2IBrh9p1W7CMvfkvjO62nM6oqh6vdKmgW4Im/PG+7DYpLAIHY+C0WsbI2BKDTHNYu
        VKBmUjgMwfz+peks7pJBUgT74XR954vnOvMn0IiSV/+aoHANzeA9dxkt5W5YW1gBK9sw3eTQ
        9jcRJzswkuHqgE+HFqGFzIgBYB+769+vUdbVEIDKPQXJB94VoLv2oFe1eOQhIbuBTZtDe2x6
        DCE3Nw==
        =Kaig
        -----END PGP PUBLIC KEY BLOCK-----
  prometheus-ceph-exporter:
    charm: cs:prometheus-ceph-exporter
    series: bionic
    bindings:
      "": *oam-space
      ceph: *ceph-public-space
    num_units: 1
    to:
    - lxd:1001
  #Vault/FDE
  easyrsa:
    charm: cs:~containers/easyrsa
    num_units: 1
    bindings:
      "": *oam-space
    to:
    - lxd:1004
  etcd:
    charm: cs:etcd
    num_units: 3
    constraints: spaces=oam-space
    bindings:
      "": *internal-space
    options:
      channel: 3.2/stable
    to:
    - lxd:1001
    - lxd:1003
    - lxd:1005
  vault:
    charm: cs:vault
    num_units: 3
    bindings:
      "": *internal-space
    options:
      vip: *vault-vip
    to:
    - 15
    - 16
    - 17
relations:
  # openstack
  - [ aodh, mysql ]
  - [ aodh, keystone ]
  - [ "aodh:amqp", "rabbitmq-server:amqp" ]
  - [ aodh, nrpe-container ]
  - [ aodh, telegraf ]
  - [ aodh, filebeat ]
  - [ aodh, logrotate ]
  - [ ceph-osd, ceph-mon ]
  - [ ceph-radosgw, ceph-mon ]
  - [ keystone, ceph-radosgw ]
  - [ keystone, keystone-ldap ]
  - [ nova-compute-kvm, ntp ]
  - [ neutron-gateway, ntp ]
  - [ nova-compute-kvm, lldpd ]
  - [ neutron-gateway, lldpd ]
  - [ nova-compute-kvm, canonical-livepatch ]
  - [ neutron-gateway, canonical-livepatch ]
  - [ ceph-radosgw, hacluster-radosgw ]
  - [ mysql, hacluster-mysql ]
  - [ keystone, hacluster-keystone ]
  - [ aodh, hacluster-aodh ]
  - [ glance, hacluster-glance ]
  - [ gnocchi, hacluster-gnocchi ]
  - [ cinder, hacluster-cinder ]
  - [ designate, hacluster-designate ]
  - [ neutron-api, hacluster-neutron ]
  - [ nova-cloud-controller, hacluster-nova ]
  - [ openstack-dashboard, hacluster-horizon ]
  - [ heat, hacluster-heat ]
  - [ keystone, mysql ]
  - [ "ceilometer:identity-credentials", "keystone:identity-credentials" ]
  - [ "ceilometer:amqp", "rabbitmq-server:amqp" ]
  - [ ceilometer, hacluster-ceilometer ]
  - [ cinder, mysql ]
  - [ cinder, keystone ]
  - [ cinder-ceph, ceph-mon ]
  - [ cinder-ceph, cinder ]
  - [ "cinder:amqp", "rabbitmq-server:amqp" ]
  - [ designate, mysql ]
  - [ designate, designate-bind ]
  - [ designate, keystone ]
  - [ "designate:amqp", "rabbitmq-server:amqp" ]
  - [ designate, memcached ]
  - [ glance, mysql ]
  - [ glance, keystone ]
  - [ glance, ceph-mon ]
  - [ "glance:amqp", "rabbitmq-server:amqp" ]
  - [ gnocchi, mysql ]
  - [ "gnocchi:amqp", "rabbitmq-server:amqp" ]
  - [ gnocchi, keystone ]
  - [ gnocchi, ceph-mon ]
  - [ gnocchi, memcached ]
  - [ gnocchi, ceilometer ]
  - [ gnocchi, filebeat ]
  - [ gnocchi, logrotate ]
  - [ gnocchi, telegraf ]
  - [ gnocchi, nrpe-container ]
  - [ heat, mysql ]
  - [ heat, keystone ]
  - [ "heat:amqp", "rabbitmq-server:amqp" ]
  - [ "nova-cloud-controller:shared-db", "mysql:shared-db" ]
  - [ "nova-cloud-controller:amqp", "rabbitmq-server:amqp" ]
  - [ nova-cloud-controller, keystone ]
  - [ nova-cloud-controller, glance ]
  - [ "nova-cloud-controller:memcache", "memcached:cache" ]
  - [ neutron-api, mysql ]
  - [ "neutron-api:amqp", "rabbitmq-server:amqp" ]
  - [ neutron-api, nova-cloud-controller ]
  - [ neutron-api, keystone ]
  - [ neutron-gateway, nova-cloud-controller ]
  - [ "neutron-gateway:amqp", "rabbitmq-server:amqp" ]
  - [ "neutron-gateway:neutron-plugin-api", "neutron-api:neutron-plugin-api" ]
  - [ "neutron-openvswitch:amqp", "rabbitmq-server:amqp" ]
  - [ neutron-openvswitch, neutron-api ]
  - [ "nova-compute-kvm:amqp", "rabbitmq-server:amqp" ]
  - [ nova-compute-kvm, ceph-mon ]
  - [ nova-compute-kvm, cinder-ceph ]
  - [ nova-compute-kvm, glance ]
  - [ nova-compute-kvm, neutron-openvswitch ]
  - [ nova-compute-kvm, nova-cloud-controller ]
  - [ "openstack-dashboard:identity-service", "keystone:identity-service" ]
  - [ openstack-dashboard, mysql ]
  - [ ceilometer-agent, nova-compute-kvm ]
  - [ ceilometer-agent, ceilometer ]
  - [ "ceilometer-agent:amqp", "rabbitmq-server:amqp" ]
  - [ "bcache-tuning:juju-info", "ceph-osd:juju-info" ]
  - [ nova-compute-kvm, filebeat ]
  - [ nova-compute-kvm, logrotate ]
  - [ nova-compute-kvm, nrpe-host ]
  - [ "nova-compute-kvm:juju-info", "telegraf:juju-info" ]
  - [ neutron-gateway, filebeat ]
  - [ neutron-gateway, logrotate ]
  - [ neutron-gateway, nrpe-host ]
  - [ "neutron-gateway:juju-info", "telegraf:juju-info" ]
  - [ ceph-mon, nrpe-container ]
  - [ "ceph-mon:juju-info", "telegraf:juju-info" ]
  - [ ceph-mon, filebeat ]
  - [ ceph-mon, logrotate ]
  - [ ceph-radosgw, filebeat ]
  - [ ceph-radosgw, logrotate ]
  - [ ceph-radosgw, nrpe-container ]
  - [ "ceph-radosgw:juju-info", "telegraf:juju-info" ]
  - [ cinder, filebeat ]
  - [ cinder, logrotate ]
  - [ cinder, nrpe-container ]
  - [ "cinder:juju-info", "telegraf:juju-info" ]
  - [ "glance:image-service", "cinder:image-service" ]
  - [ glance, filebeat ]
  - [ glance, logrotate ]
  - [ glance, nrpe-container ]
  - [ "glance:juju-info", "telegraf:juju-info" ]
  - [ keystone, filebeat ]
  - [ keystone, logrotate ]
  - [ keystone, nrpe-container ]
  - [ "keystone:juju-info", "telegraf:juju-info" ]
  - [ mysql, filebeat ]
  - [ mysql, logrotate ]
  - [ mysql, nrpe-container ]
  - [ "mysql:juju-info", "telegraf:juju-info" ]
  - [ neutron-api, filebeat ]
  - [ neutron-api, logrotate ]
  - [ neutron-api, nrpe-container ]
  - [ "neutron-api:juju-info", "telegraf:juju-info" ]
  - [ nova-cloud-controller, filebeat ]
  - [ nova-cloud-controller, logrotate ]
  - [ nova-cloud-controller, nrpe-container ]
  - [ "nova-cloud-controller:juju-info", "telegraf:juju-info" ]
  - [ openstack-dashboard, filebeat ]
  - [ openstack-dashboard, logrotate ]
  - [ openstack-dashboard, nrpe-container ]
  - [ "openstack-dashboard:juju-info", "telegraf:juju-info" ]
  - [ rabbitmq-server, filebeat ]
  - [ rabbitmq-server, logrotate ]
  - [ rabbitmq-server, nrpe-container ]
  - [ "rabbitmq-server:juju-info", "telegraf:juju-info" ]
  - [ heat, filebeat ]
  - [ heat, logrotate ]
  - [ heat, nrpe-container ]
  - [ "heat:juju-info", "telegraf:juju-info" ]
  - [ designate, filebeat ]
  - [ designate, logrotate ]
  - [ designate, nrpe-container ]
  - [ "designate:juju-info", "telegraf:juju-info" ]
  - [ designate, neutron-api ]
  - [ designate-bind, filebeat ]
  - [ designate-bind, logrotate ]
  - [ designate-bind, nrpe-container ]
  - [ "designate-bind:juju-info", "telegraf:juju-info" ]
  - [ ceilometer, filebeat ]
  - [ ceilometer, logrotate ]
  - [ ceilometer, nrpe-container ]
  - [ "ceilometer:juju-info", "telegraf:juju-info" ]
  - [ "graylog:beats", "filebeat:logstash" ]
  - [ graylog, ntp ]
  - [ graylog, nrpe-host ]
  - [ "graylog:juju-info", "telegraf:juju-info" ]
  - [ graylog, canonical-livepatch ]
  - [ elasticsearch, ntp ]
  - [ "elasticsearch:juju-info", "filebeat:beats-host" ]
  - [ elasticsearch, nrpe-host ]
  - [ "elasticsearch:juju-info", "telegraf:juju-info" ]
  - [ elasticsearch, canonical-livepatch ]
  - [ "nagios:juju-info", "filebeat:beats-host" ]
  - [ "nagios:juju-info", "telegraf:juju-info" ]
  - [ "nagios:juju-info", canonical-livepatch ]
  - [ prometheus, filebeat ]
  - [ prometheus, logrotate ]
  - [ prometheus, ntp ]
  - [ prometheus, nrpe-host ]
  - [ "prometheus:juju-info", "telegraf-prometheus:juju-info" ]
  - [ "prometheus:grafana-source", "grafana:grafana-source" ]
  - [ grafana, filebeat ]
  - [ grafana, logrotate ]
  - [ prometheus, canonical-livepatch ]
  - [ grafana, ntp ]
  - [ grafana, nrpe-host ]
  - [ "grafana:juju-info", "telegraf:juju-info" ]
  - [ grafana, canonical-livepatch ]
  - [ nagios, nrpe-container ]
  - [ nagios, nrpe-host ]
  - [ graylog, elasticsearch ]
  - [ graylog, graylog-mongodb ]
  - [ "prometheus:target", "telegraf:prometheus-client" ]
  - [ "prometheus:target", "telegraf-prometheus:prometheus-client" ]
  - [ openstack-service-checks, nrpe-container ]
  - [ openstack-service-checks, telegraf ]
  - [ openstack-service-checks, filebeat ]
  - [ openstack-service-checks, logrotate ]
  - [ "openstack-service-checks:identity-credentials", "keystone:identity-credentials" ]
  - [ "openstack-service-checks:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "prometheus-openstack-exporter:identity-credentials", "keystone:identity-credentials" ]
  - [ "prometheus-openstack-exporter:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "prometheus-openstack-exporter:prometheus-openstack-exporter-service", "prometheus:target" ]
  - [ prometheus-openstack-exporter, filebeat ]
  - [ prometheus-openstack-exporter, logrotate ]
  - [ prometheus-openstack-exporter, "telegraf:juju-info" ]
  - [ graylog-mongodb, nrpe-container ]
  - [ graylog-mongodb, "telegraf:juju-info" ]
  - [ graylog-mongodb, "filebeat:beats-host" ]
# Vault/FDE
  - [ vault, hacluster-vault ]
  - [ "ceph-osd:secrets-storage", "vault:secrets" ]
  - [ "vault:shared-db", "mysql:shared-db"]
  - [ "etcd:certificates", "easyrsa:client" ]
  - [ "etcd:db", "vault:etcd" ]
  - [ "vault:secrets", "nova-compute-kvm:secrets-storage" ]
  - [ vault, canonical-livepatch ]
  - [ telegraf, vault ]
  - [ telegraf, etcd ]
  - [ telegraf, easyrsa ]
  - [ filebeat, vault ]
  - [ filebeat, etcd ]
  - [ filebeat, easyrsa ]
  - [ nrpe-container, easyrsa ]
  - [ nrpe-container, etcd ]
  - [ nrpe-container, vault ]
  - [ ntp, vault ]
# Additional relationship requirements
  - [ telegraf, prometheus-openstack-exporter ]
  - [ prometheus-ceph-exporter, nrpe-container ]
  - [ telegraf, prometheus-ceph-exporter ]
  - [ filebeat, prometheus-ceph-exporter ]
  - [ logrotate, prometheus-ceph-exporter ]
  - [ filebeat, "elasticsearch:juju-info" ]
  - [ "ntp:juju-info", "nagios:juju-info" ]
  - [ "thruk-agent:general-info", "nagios:juju-info" ]
  - [ prometheus-ceph-exporter, "ceph-mon:client" ]
  - [ prometheus-ceph-exporter, "prometheus:target" ]
  - [ "ceilometer:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "ceph-mon:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "ceph-osd:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "ceph-radosgw:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "cinder:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "elasticsearch:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "glance:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "grafana:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "graylog-mongodb:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "graylog:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "hacluster-aodh:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-ceilometer:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-cinder:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-designate:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-glance:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-gnocchi:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-heat:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-horizon:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-keystone:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-mysql:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-neutron:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-nova:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "hacluster-radosgw:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "keystone:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "mysql:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "neutron-api:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "neutron-gateway:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "nova-cloud-controller:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "nova-compute-kvm:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "openstack-dashboard:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "prometheus-ceph-exporter:nrpe-external-master", "nrpe-container:nrpe-external-master" ]
  - [ "prometheus:nrpe-external-master", "nrpe-host:nrpe-external-master" ]
  - [ "rabbitmq-server:nrpe-external-master", "nrpe-container:nrpe-external-master" ]

  # Public policy-routing relations
  - ["public-policy-routing:juju-info", "aodh:juju-info"]
  - ["public-policy-routing:juju-info", "ceilometer:juju-info"]
  - ["public-policy-routing:juju-info", "ceph-radosgw:juju-info"]
  - ["public-policy-routing:juju-info", "cinder:juju-info"]
  - ["public-policy-routing:juju-info", "designate:juju-info"]
  - ["public-policy-routing:juju-info", "designate-bind:juju-info"]
  - ["public-policy-routing:juju-info", "glance:juju-info"]
  - ["public-policy-routing:juju-info", "gnocchi:juju-info"]
  - ["public-policy-routing:juju-info", "heat:juju-info"]
  - ["public-policy-routing:juju-info", "keystone:juju-info"]
  - ["public-policy-routing:juju-info", "neutron-api:juju-info"]
  - ["public-policy-routing:juju-info", "nova-cloud-controller:juju-info"]
  - ["public-policy-routing:juju-info", "openstack-dashboard:juju-info"]