6610 Commits

Author SHA1 Message Date
Zuul
2845861ef9 Merge "Fix deploy/genconfig in check mode" 2023-03-23 10:55:24 +00:00
Zuul
0d42110e01 Merge "Improve RabbitMQ performance by reducing ha replicas" 2023-03-20 12:17:42 +00:00
Zuul
13f4f78c6f Merge "Add flag to change RabbitMQ ha-mode definition" 2023-03-20 11:52:43 +00:00
Zuul
648870d275 Merge "RabbitMQ: Support setting ha-promote-on-shutdown" 2023-03-20 11:50:47 +00:00
Zuul
d6bfec4ad2 Merge "cloudkitty: set cafile for fetcher_keystone" 2023-03-20 10:41:19 +00:00
Michal Nasiadka
f5b3f9d22b ironic: fix dev mode for inspector
Change-Id: I1649a389bdc3977b936402c3ce3e55056d74ba08
2023-03-15 09:44:35 +00:00
Zuul
76268b7221 Merge "iscsi: Use assert on checks for readability" 2023-03-12 13:50:01 +00:00
Zuul
21e2434b59 Merge "etcd: Set the proper peer and client protocol when tls is enabled" 2023-03-09 08:06:05 +00:00
Matthew N Heler
5d3eed23a7 Set the etcd internal hostname and cacert for tls internal enabled
deployments

This allows services to work with etcd when coordination is enabled
for TLS internal deployments. Without this fix, we fail to connect to
etcd with the coordination backend and the service itself crashes.

Change-Id: I0c1d6b87e663e48c15a846a2774b0a4531a3ca68
2023-03-02 06:48:40 -06:00
Matthew N Heler
ee336ac45c etcd: Set the proper peer and client protocol when tls is enabled
Partial-Bug: #1930109

Change-Id: I383b2b5a139d24a419145473b66a34c06e32060a
2023-03-01 14:25:56 +00:00
Zuul
ad745bf1f8 Merge "hacluster: Use nodename to align with nova service names" 2023-02-22 20:38:43 +00:00
Zuul
ff0fca8fdc Merge "Switch trove-api to wsgi running under apache." 2023-02-20 16:46:42 +00:00
Matthew N Heler
e1ae8223f9 hacluster: Use nodename to align with nova service names
For Masakari and HACluster to work properly, the hostnames used
in HACluster need to match with the hostnames used in Nova.

Change-Id: Iac917ef4471905caab591cd64eab379e150a8524
2023-02-18 04:33:59 +00:00
Zuul
b1e5a97028 Merge "Use loadbalancer to connect to etcd" 2023-02-17 08:55:34 +00:00
Zuul
5ee602fcf1 Merge "ansible: Use assert on checks for readability" 2023-02-17 08:55:31 +00:00
Zuul
8f15011134 Merge "neutron: Use assert on checks for readability" 2023-02-17 08:55:28 +00:00
Zuul
4a0f058c54 Merge "rabbitmq: Use assert on checks for readability" 2023-02-17 08:40:25 +00:00
Zuul
b2dcfa0824 Merge "host_os: Use assert on checks for readability" 2023-02-17 08:39:24 +00:00
Mark Goddard
572ff2f8dc Fix deploy/genconfig in check mode
Previously, when running one of the following commands:

  kolla-ansible deploy --check
  kolla-ansible genconfig --check

deployment or configuration generation fails for various reasons.

MariaDB fails to lookup the existing cluster.

Keystone fails to generate cron config.

Nova-cell fails to get the cell settings.

Closes-Bug: #2002661
Change-Id: I5e765f498ae86d213d0a4379ca5d473db1499962
2023-02-14 17:18:16 +00:00
Zuul
0a128d24b9 Merge "Put etcd behind HTTP loadbalancer" 2023-02-14 11:31:09 +00:00
John Garbutt
6cf22b0cb1 Improve RabbitMQ performance by reducing ha replicas
Currently we do not follow the RabbitMQ advice on replicas here:
https://www.rabbitmq.com/ha.html#replication-factor

Here we reduce the number of replicas to n // 2 + 1 as advised
above. The hope it this helps speed up recovery from rabbit
issues.

Related-Bug: #1954925
Change-Id: Ib6bcb26c499c9884faa4a0cd51abaec00cacb096
2023-02-14 10:56:11 +00:00
Matt Crees
e13072a98d Add flag to change RabbitMQ ha-mode definition
Adds the flag `rabbitmq_ha_replica_count` to change how many different
nodes a queue should be mirrored across. If the value is not set, then
it defaults to "ha-mode":"all". This value is unset by default to avoid
any unexpected changes to the RabbitMQ definitions.json file, as that
would trigger an unexpected restart of RabbitMQ during the next deploy.

Change-Id: Iee98cd937197a73a3b04aa8501fa325e8ecfff24
2023-02-14 10:51:46 +00:00
Will Szumski
e2c7dace44 Use loadbalancer to connect to etcd
Hardcoding the first etcd host creates a single point of failure.

Change-Id: I0f83030fcd84ddcdc4bf2226e76605c7cab84cbb
2023-02-14 10:16:55 +00:00
Zuul
4ba17d6da4 Merge "loadbalancer: Use assert on checks for readability" 2023-02-13 16:19:50 +00:00
Zuul
ffa9c307b4 Merge "zun: Use assert on checks for readability" 2023-02-13 16:19:48 +00:00
Will Szumski
6f536a4f71 Put etcd behind HTTP loadbalancer
etcd-compatible tooz drivers do not support multiple endpoints via
backend_url. We can put a loadbalancer in front of etcd and configure
backend_url to use the VIP instead. The issue with hard coding the first
host is that we break coordination if we take this host offline. In the
case of cinder, we would not be able to perform any volume related
operations.

Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: Ib684501ba03c386dc5ac71e5cbea05c99f191665
2023-02-13 11:45:53 +00:00
Zuul
df12f2ce02 Merge "Default neutron_tls_proxy and glance_tls_proxy to haproxy_tag" 2023-02-10 14:47:49 +00:00
John Garbutt
94f3ce0c78 RabbitMQ: Support setting ha-promote-on-shutdown
By default ha-promote-on-shutdown=when-synced. However we are seeing
issues with RabbitMQ automatically recovering when nodes are restarted.
https://www.rabbitmq.com/ha.html#cluster-shutdown

Rather than waiting for operator interventions, it is better we allow
recovery to happen, even if that means we may loose some messages.
A few failed and timed out operations is better than a totaly broken
cloud. This is achieved using ha-promote-on-shutdown=always.

Note, when a node failure is detected, this is already the default
behaviour from 3.7.5 onwards:
https://www.rabbitmq.com/ha.html#promoting-unsynchronised-mirrors

This patch adds the option to change the ha-promote-on-shutdown
definition, using the flag `rabbitmq_ha_promote_on_shutdown`. This
value is unset by default to avoid any unexpected changes to the
RabbitMQ definitions.json file, as that would trigger an unexpected
restart of RabbitMQ during the next deploy.

Related-Bug: #1954925

Change-Id: I2146bda2c72ddac2c9923c6941b0596395fd9ab5
2023-02-09 13:49:07 +00:00
Zuul
75bd313678 Merge "Trivial: Add connection: local for keystone-fernet cron generate task" 2023-02-08 00:15:59 +00:00
Zuul
bc5e462143 Merge "remove elasticsearch remnants in antelope cycle" 2023-02-07 17:34:36 +00:00
Bartosz Bezak
ee658f4549 remove elasticsearch remnants in antelope cycle
Change-Id: I115b491eca413437926f5bcaf53336151f9a7c0b
2023-02-07 11:25:27 +01:00
wu.chunyang
303998e294 Switch trove-api to wsgi running under apache.
This change also adds support for Trove backend TLS.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/854744
Change-Id: I2acf7820b24b112b57b0c00a01f5c4b8cb85ce25
2023-02-02 01:22:59 +00:00
Michal Arbet
78cf9585b7 Trivial: Add connection: local for keystone-fernet cron generate task
This patch add connection local for above mentioned task as
kolla-ansible can be executed in docker container as in
my case.

When there is no connection: local, ansible is trying to connect
to localhost via ssh where specified python script is not available.

After connection: local everything is working as expected as file
is found inside container

Closes-Bug: #2004224

Change-Id: I219a958b4f101efb71a2935e6d910dae5c65f0be
2023-01-31 06:48:40 +01:00
yangshaoxue
113b77c8cb Add skyline service
Support to deploy skyline by kolla-ansible.

Implements: blueprint skyline
Depends-On: https://review.opendev.org/c/openstack/kolla/+/826948

Change-Id: Ice5621491a432ba32138abd6f62d1f815cc219e0
2023-01-31 13:47:18 +08:00
Bartosz Bezak
95895d5b06 Default neutron_tls_proxy and glance_tls_proxy to haproxy_tag
neutron_tls_proxy and glance_tls_proxy are using haproxy container
image. Pin them to haproxy_tag directly.

Change-Id: I73142db48ebe6641520d21b560f16de892e07c34
2023-01-30 16:45:56 +00:00
Zuul
66ec9cef55 Merge "Remove support for Ubuntu Focal 20.04 hosts" 2023-01-30 14:50:57 +00:00
Zuul
98139b0f10 Merge "Remove system scope token to access services" 2023-01-30 13:03:13 +00:00
Bartosz Bezak
6db6bc0a9f Remove support for Ubuntu Focal 20.04 hosts
Users running on a Focal host will now fail in prechecks.

Change-Id: Icaef4b25458490e46f623b055658abc678d2f1c6
2023-01-29 14:28:51 +00:00
Ghanshyam Mann
283fa242ca Remove system scope token to access services
As per the RBAC new direction in Zed cycle, we have dropped the
system scope from API policies and all the policies are hardcoded
to project scoped so that any user accessing APIs using system scope
will get 403 error. It is dropped from all the OpenStack services
except for the Ironic service which will have system scope and to
support ironic only deployment, we are keeping system as well as project
scope in Keystone.

Complete discussion and direction can be found in the below gerrit
change and TC goal direction:

- https://review.opendev.org/c/openstack/governance/+/847418
- https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#the-issues-we-are-facing-with-scope-concept

As phase-2 of RBAC goal, services will start enabling the new
defaults and project scope by default. For example: Nova did in
- https://review.opendev.org/c/openstack/nova/+/866218

Kolla who start accessing the services using system scope token
- https://review.opendev.org/c/openstack/kolla-ansible/+/692179

This commit partially revert the above change except keeping
system scope usage for Keystone and Ironic. Rest all services are changed
to use the project scope token.

And enable the scope and new defaults for Nova which was disabled
by https://review.opendev.org/c/openstack/kolla-ansible/+/870804

Change-Id: I0adbe0a6c39e11d7c9542569085fc5d580f26c9d
2023-01-26 17:52:00 -06:00
Zuul
38ccebb8cb Merge "Add systemd container control" 2023-01-25 18:43:47 +00:00
Zuul
99d1e3c710 Merge "Adding optional delay between l3 agent restarts" 2023-01-25 14:08:06 +00:00
Zuul
cab09e31dc Merge "Add ability to configure rabbitmq" 2023-01-25 11:20:23 +00:00
Alex-Welsh
391aa4677f Adding optional delay between l3 agent restarts
This change serialises the neutron l3 agent restart process and adds a
user configurable delay between restarts. This can prevent connectivity
loss due to all agents being restarted at the same time.

Routers increase the recovery time, making this issue more prevalent.

Change-Id: I3be0ebfa12965e6ae32d1b5f13f8fd23c3f52b8c
2023-01-23 09:14:59 +00:00
Stanislav Dmitriev
0b62db7cc4 Set scheduler.max_attempts for nova conductor
In order to honour configured max number of attempts
it has to be presented in nova.conf inside of
nova_conductor container, otherwise the default value
of 3 will be used

Closes-Bug: #2003587
Change-Id: I928af332b8658223444594f96417830233057284
2023-01-20 17:10:52 -05:00
Zuul
32dce70f09 Merge "Drop skydive" 2023-01-19 10:26:01 +00:00
Martin Hiner
4866017e52 Add systemd container control
This commit adds SystemdWorker class to kolla_docker ansible module.
It is used to manage container state via systemd calls.

Change-Id: I20e65a6771ebeee462a3aaaabaa5f0596bdd0581
Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com>
Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>
2023-01-19 10:38:41 +01:00
Zuul
08267a59ce Merge "Stop firewalld config during kolla genconfig" 2023-01-18 16:26:19 +00:00
Zuul
1b5f64c013 Merge "Remove use_forwarded_for configuration option" 2023-01-18 13:15:56 +00:00
Zuul
7c79d73ec1 Merge "Remove [trustee]/auth_uri option from heat.conf" 2023-01-18 13:09:55 +00:00
Michal Arbet
701dc20f50 Add ability to configure rabbitmq
As rabbitmq's configuration file is not ini or yaml file,
there is no option to extend configuration by new config
options via merge_configs or merge_yaml.

This patch moves config options to dictionary
so it can be overriden in /etc/kolla/globals.yml.

Change-Id: I5cd772f4fb80a0e200fb24d67be735ca81e3fdeb
2023-01-17 22:03:54 +01:00