By resetting image_upload_use_cinder_backend to upstream default.
When uploading volume to glance image, cinder looks at the backend's
image_upload_use_cinder_backend config knob to decide whether to try link
the glance image to a cloned volume made by cinder, i.e. by doing all work
locally and only updating glance's locations for the image (when the knob
is set to True). However, after all [1], [2] and [3], which happens since
Victoria, this option requires further config from user (using volume type
with image_service:store_id property (aka extra spec) set to the desired
glance store (even if there is only one cinder store configured).
Please read the bug report as to why the option removal is the
best option (TL;DR it is the most compatible approach).
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/708114
[2] https://review.opendev.org/c/openstack/glance_store/+/746556
[3] https://review.opendev.org/c/openstack/cinder/+/661676
Closes-Bug: #1991516
Change-Id: Ife87ee0241d907a0c407eb21811a354ed1734408
These are not used by the relevant daemons and so can be dropped to,
e.g., avoid creating the cinder volume on hosts where there is no
cinder.
Change-Id: Ia8d906a9e0227f361883a7ec1ec8dcd73e4104dc
This is generally considered insecure because it may reveal
sensitive data [1].
Furthermore, it happens that the default Ceph perms cause fatal
ERRORs with this setting:
1) when Glance wants to remove an image, it cannot list children
because Cinder or Nova might have created a linked volume clone
behind the scenes and it is put in another pool (volumes/vms)
which Glance cannot normally access;
2) when Nova wants to create an image, it lacks permissions
to write to the images pool.
Thus, I propose that Kolla Ansible stops setting this by default
and relies on the working defaults.
The downside is that this disables optimisations in Cinder and Nova.
On the other hand, these optimisations have nasty behaviour of
being linked directly to the original image, preventing its removal.
[1] https://docs.openstack.org/glance/yoga/configuration/glance_api.html#DEFAULT.show_multiple_locations
Change-Id: I63ee9a6eefd8593f2169bba34dbb699f413d7cf8
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/860093
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/860291
Closes-Bug: #1992153
Currently kolla-ansible sets haproxy balance algorithm to source for
horizon. We can set it to round-robin if the cache backend is memcached
or using the database as the session storage backend. So we can
distribute http requests evenly to all available horizon instances.
Closes-Bug: #1990523
Change-Id: I0721cadcf53d59947bc0db6a193bfafe49c41ad3
This patch also changes python version and default tag for centos.
prometheus-efk and venus jobs commented out, elasticsearch images
are unbuildable
cells is commented out because proxysql is unbuildable
Change-Id: Ic358f8b600317d3c2fc45130a59785225aea1153
JWT failed to validate on auth-oidc endpoint used by openstack cli
with "could not find key with kid: XX" error. To fix this we need
to use jwks provided in "jwks_uri" by OIDC metadata endpoint.
Missing "ServerName" directive from vhost config causes redirection
to fail in some cases when external tls is enabled.
- added "keystone_federation_oidc_jwks_uri" variable
- added "OIDCOAuthVerifyJwksUri" to keystone vhost config
- added "ServerName" to keystone vhost config
- jinja templating additional whitespace trimmed to
correct end result indentation and empty newlines
Closes-bug: 1990375
Change-Id: I4f5c1bd8be8e23cf6299ca4bdfd79e9d98c9a9eb
With this option enabled, dnsmasq can offer the same IP address to
multiple hosts when their requests are close to each other. Remove this
option in order to use the built-in hashing mechanism which will
allocate random IP addresses, which should be less likely to conflict.
Closes-Bug: #1991390
Change-Id: I09a9fa2d0c54635b899ad7906cc2e2e4580ef5ad
CirrOS 0.6.0 was released yesterday. Has newer kernel and userspace,
better network configuration (more IPv6 stuff) and some other
improvements.
Change-Id: Ife7767904efe64602531fa3eb163c78260650909
Bind9 is running without limit for UDP listeners.
This patch is changing this behaviour and sets max 32
of UDP listeners. This is needed because of bug below [1].
[1] https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1827923
Change-Id: Ie4c2ac4d5e990ebdc30c3a94d855703d814f1fee
Kolla Ansible stopped setting them as they turned out to be
unnecessary for its operations, yet may have conflicted with
security policies of the hosts. [1] [2]
[1] https://launchpad.net/bugs/1837551
[2] https://launchpad.net/bugs/1945453
Change-Id: Ie8ccd3ab6f22a6f548b1da8d3acd334068dc48f5
removed:
- 701 [galaxy_info missing] is no longer emited
- 602 [empty string compare] is now opt-in
- 208 [permissions not mentioned] is no longer emited
- 106 [role name] is no longer emited
renamed from number to role name:
- 503 [no-handler]
- 301 [no-changed-when]
Change-Id: I8b059d87c94499decbd9b115ef2cde033aa88fbd
With the release of ansible-lint 6.7.0, the openstack-tox-linters job
started failing with these errors:
WARNING Listing 30 violation(s) that are fatal
ansible/roles/ceilometer/tasks/config.yml:66: name: Jinja templates should only be at the end of 'name' (name[template])
[...]
Add this new check to skip_list for now.
Change-Id: Ia82a88ee3b9bb6a3cb09f09c6568d1914ee2592d
