7363 Commits

Author SHA1 Message Date
Zuul
21e2434b59 Merge "etcd: Set the proper peer and client protocol when tls is enabled" 2023-03-09 08:06:05 +00:00
Zuul
f565011d98 Merge "Set the etcd internal hostname and cacert for tls internal enabled deployments" 2023-03-08 18:36:46 +00:00
Christian Berendt
a78127414c rabbitmq: add rabbitmq_datadir_volume parameter
With the parameter rabbitmq_datadir_volume it is possible
to use a directory as volume for the rabbitmq service. By default,
a volume named rabbitmq is used (the previous default).

Change-Id: I99d6bd71ca79cba81062dedfb767c5ed341bb182
2023-03-06 23:49:11 +01:00
Christian Berendt
b327ae4a56 mariadb: add mariadb_datadir_volume parameter
With the parameter ``mariadb_datadir_volume`` it is possible
to use a directory as volume for the mariadb service. By default,
a volume named mariadb is used (the previous default).

Change-Id: Ic61fe981825c5fa6f50e53c9555b6a102f42f522
2023-03-06 23:45:23 +01:00
Christian Berendt
6768b760ab Add neutron_ovn_availability_zones parameter
With the new ``neutron_ovn_availability_zones`` parameter it is possible
to define network availability zones for OVN. Further details can be found
in the Neutron OVN documentation:
https://docs.openstack.org/neutron/latest/admin/ovn/availability_zones.html#how-to-configure-it

Change-Id: I203e0d400a3218d0b4a41f2a948207032c4febec
2023-03-06 13:28:28 +00:00
Matthew N Heler
5d3eed23a7 Set the etcd internal hostname and cacert for tls internal enabled
deployments

This allows services to work with etcd when coordination is enabled
for TLS internal deployments. Without this fix, we fail to connect to
etcd with the coordination backend and the service itself crashes.

Change-Id: I0c1d6b87e663e48c15a846a2774b0a4531a3ca68
2023-03-02 06:48:40 -06:00
Zuul
308089bb64 Merge "Refactor DockerWorker into ContainerWorker" 2023-03-01 15:40:04 +00:00
Matthew N Heler
ee336ac45c etcd: Set the proper peer and client protocol when tls is enabled
Partial-Bug: #1930109

Change-Id: I383b2b5a139d24a419145473b66a34c06e32060a
2023-03-01 14:25:56 +00:00
Zuul
ad745bf1f8 Merge "hacluster: Use nodename to align with nova service names" 2023-02-22 20:38:43 +00:00
Zuul
ff0fca8fdc Merge "Switch trove-api to wsgi running under apache." 2023-02-20 16:46:42 +00:00
Ivan Halomi
9a14a306ca Refactor DockerWorker into ContainerWorker
Fourth part of patchset:
https://review.opendev.org/c/openstack/kolla-ansible/+/799229/
which was suggested to be split into smaller patches.

This commit refactors select methods from DockerWorker class
into ContainerWorker class. New class contains Docker independent
methods also used in Podman introduction and is inteded as a
parent class for specific worker classes.

Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com>
Co-authored-by: Martin Hiner <m.hiner@partner.samsung.com>
Change-Id: I2dd5920410dda053f2dfedc4e2666c56b1a7095a
2023-02-20 14:12:00 +01:00
Matthew N Heler
e1ae8223f9 hacluster: Use nodename to align with nova service names
For Masakari and HACluster to work properly, the hostnames used
in HACluster need to match with the hostnames used in Nova.

Change-Id: Iac917ef4471905caab591cd64eab379e150a8524
2023-02-18 04:33:59 +00:00
Zuul
b1e5a97028 Merge "Use loadbalancer to connect to etcd" 2023-02-17 08:55:34 +00:00
Zuul
5ee602fcf1 Merge "ansible: Use assert on checks for readability" 2023-02-17 08:55:31 +00:00
Zuul
8f15011134 Merge "neutron: Use assert on checks for readability" 2023-02-17 08:55:28 +00:00
Zuul
4a0f058c54 Merge "rabbitmq: Use assert on checks for readability" 2023-02-17 08:40:25 +00:00
Zuul
b2dcfa0824 Merge "host_os: Use assert on checks for readability" 2023-02-17 08:39:24 +00:00
Mark Goddard
572ff2f8dc Fix deploy/genconfig in check mode
Previously, when running one of the following commands:

  kolla-ansible deploy --check
  kolla-ansible genconfig --check

deployment or configuration generation fails for various reasons.

MariaDB fails to lookup the existing cluster.

Keystone fails to generate cron config.

Nova-cell fails to get the cell settings.

Closes-Bug: #2002661
Change-Id: I5e765f498ae86d213d0a4379ca5d473db1499962
2023-02-14 17:18:16 +00:00
Zuul
0a128d24b9 Merge "Put etcd behind HTTP loadbalancer" 2023-02-14 11:31:09 +00:00
John Garbutt
6cf22b0cb1 Improve RabbitMQ performance by reducing ha replicas
Currently we do not follow the RabbitMQ advice on replicas here:
https://www.rabbitmq.com/ha.html#replication-factor

Here we reduce the number of replicas to n // 2 + 1 as advised
above. The hope it this helps speed up recovery from rabbit
issues.

Related-Bug: #1954925
Change-Id: Ib6bcb26c499c9884faa4a0cd51abaec00cacb096
2023-02-14 10:56:11 +00:00
Matt Crees
e13072a98d Add flag to change RabbitMQ ha-mode definition
Adds the flag `rabbitmq_ha_replica_count` to change how many different
nodes a queue should be mirrored across. If the value is not set, then
it defaults to "ha-mode":"all". This value is unset by default to avoid
any unexpected changes to the RabbitMQ definitions.json file, as that
would trigger an unexpected restart of RabbitMQ during the next deploy.

Change-Id: Iee98cd937197a73a3b04aa8501fa325e8ecfff24
2023-02-14 10:51:46 +00:00
Will Szumski
e2c7dace44 Use loadbalancer to connect to etcd
Hardcoding the first etcd host creates a single point of failure.

Change-Id: I0f83030fcd84ddcdc4bf2226e76605c7cab84cbb
2023-02-14 10:16:55 +00:00
Zuul
4ba17d6da4 Merge "loadbalancer: Use assert on checks for readability" 2023-02-13 16:19:50 +00:00
Zuul
ffa9c307b4 Merge "zun: Use assert on checks for readability" 2023-02-13 16:19:48 +00:00
Will Szumski
6f536a4f71 Put etcd behind HTTP loadbalancer
etcd-compatible tooz drivers do not support multiple endpoints via
backend_url. We can put a loadbalancer in front of etcd and configure
backend_url to use the VIP instead. The issue with hard coding the first
host is that we break coordination if we take this host offline. In the
case of cinder, we would not be able to perform any volume related
operations.

Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: Ib684501ba03c386dc5ac71e5cbea05c99f191665
2023-02-13 11:45:53 +00:00
Zuul
df12f2ce02 Merge "Default neutron_tls_proxy and glance_tls_proxy to haproxy_tag" 2023-02-10 14:47:49 +00:00
John Garbutt
94f3ce0c78 RabbitMQ: Support setting ha-promote-on-shutdown
By default ha-promote-on-shutdown=when-synced. However we are seeing
issues with RabbitMQ automatically recovering when nodes are restarted.
https://www.rabbitmq.com/ha.html#cluster-shutdown

Rather than waiting for operator interventions, it is better we allow
recovery to happen, even if that means we may loose some messages.
A few failed and timed out operations is better than a totaly broken
cloud. This is achieved using ha-promote-on-shutdown=always.

Note, when a node failure is detected, this is already the default
behaviour from 3.7.5 onwards:
https://www.rabbitmq.com/ha.html#promoting-unsynchronised-mirrors

This patch adds the option to change the ha-promote-on-shutdown
definition, using the flag `rabbitmq_ha_promote_on_shutdown`. This
value is unset by default to avoid any unexpected changes to the
RabbitMQ definitions.json file, as that would trigger an unexpected
restart of RabbitMQ during the next deploy.

Related-Bug: #1954925

Change-Id: I2146bda2c72ddac2c9923c6941b0596395fd9ab5
2023-02-09 13:49:07 +00:00
Zuul
429ac6fc00 Merge "Fix kolla_docker module" 2023-02-08 11:53:22 +00:00
Zuul
75bd313678 Merge "Trivial: Add connection: local for keystone-fernet cron generate task" 2023-02-08 00:15:59 +00:00
Zuul
bc5e462143 Merge "remove elasticsearch remnants in antelope cycle" 2023-02-07 17:34:36 +00:00
Zuul
34c1034e30 Merge "Add skyline service" 2023-02-07 11:34:19 +00:00
Bartosz Bezak
ee658f4549 remove elasticsearch remnants in antelope cycle
Change-Id: I115b491eca413437926f5bcaf53336151f9a7c0b
2023-02-07 11:25:27 +01:00
Michal Arbet
63b9fa5639 Fix kolla_docker module
This patch fixes kolla_docker module
as it did not take into account common_options
parameter. From patchset it's visible that module's
default values are used always - even if user overrided
some param in common_options dict.

Closes-Bug: #2003079

Change-Id: I677fde708dd004decaff4bd39f2173d8d81052fb
2023-02-04 23:54:47 +01:00
Michal Nasiadka
f253f99c12 Do not support dimensions:kernel_memory on Docker API 1.42
It is deprecated in 20.10 and removed in 23.0 (and 23.0 is out) [1], [2].

[1]: https://docs.docker.com/engine/deprecated/#kernel-memory-limit
[2]: https://docs.docker.com/engine/api/version-history/#v142-api-changes

Change-Id: Ia6fa85172aad7bcd5f958922d3c224ef79882e6c
2023-02-03 11:32:32 +00:00
wu.chunyang
303998e294 Switch trove-api to wsgi running under apache.
This change also adds support for Trove backend TLS.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/854744
Change-Id: I2acf7820b24b112b57b0c00a01f5c4b8cb85ce25
2023-02-02 01:22:59 +00:00
Michal Arbet
78cf9585b7 Trivial: Add connection: local for keystone-fernet cron generate task
This patch add connection local for above mentioned task as
kolla-ansible can be executed in docker container as in
my case.

When there is no connection: local, ansible is trying to connect
to localhost via ssh where specified python script is not available.

After connection: local everything is working as expected as file
is found inside container

Closes-Bug: #2004224

Change-Id: I219a958b4f101efb71a2935e6d910dae5c65f0be
2023-01-31 06:48:40 +01:00
yangshaoxue
113b77c8cb Add skyline service
Support to deploy skyline by kolla-ansible.

Implements: blueprint skyline
Depends-On: https://review.opendev.org/c/openstack/kolla/+/826948

Change-Id: Ice5621491a432ba32138abd6f62d1f815cc219e0
2023-01-31 13:47:18 +08:00
Bartosz Bezak
95895d5b06 Default neutron_tls_proxy and glance_tls_proxy to haproxy_tag
neutron_tls_proxy and glance_tls_proxy are using haproxy container
image. Pin them to haproxy_tag directly.

Change-Id: I73142db48ebe6641520d21b560f16de892e07c34
2023-01-30 16:45:56 +00:00
Zuul
66ec9cef55 Merge "Remove support for Ubuntu Focal 20.04 hosts" 2023-01-30 14:50:57 +00:00
Zuul
98139b0f10 Merge "Remove system scope token to access services" 2023-01-30 13:03:13 +00:00
Bartosz Bezak
6db6bc0a9f Remove support for Ubuntu Focal 20.04 hosts
Users running on a Focal host will now fail in prechecks.

Change-Id: Icaef4b25458490e46f623b055658abc678d2f1c6
2023-01-29 14:28:51 +00:00
Ghanshyam Mann
283fa242ca Remove system scope token to access services
As per the RBAC new direction in Zed cycle, we have dropped the
system scope from API policies and all the policies are hardcoded
to project scoped so that any user accessing APIs using system scope
will get 403 error. It is dropped from all the OpenStack services
except for the Ironic service which will have system scope and to
support ironic only deployment, we are keeping system as well as project
scope in Keystone.

Complete discussion and direction can be found in the below gerrit
change and TC goal direction:

- https://review.opendev.org/c/openstack/governance/+/847418
- https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#the-issues-we-are-facing-with-scope-concept

As phase-2 of RBAC goal, services will start enabling the new
defaults and project scope by default. For example: Nova did in
- https://review.opendev.org/c/openstack/nova/+/866218

Kolla who start accessing the services using system scope token
- https://review.opendev.org/c/openstack/kolla-ansible/+/692179

This commit partially revert the above change except keeping
system scope usage for Keystone and Ironic. Rest all services are changed
to use the project scope token.

And enable the scope and new defaults for Nova which was disabled
by https://review.opendev.org/c/openstack/kolla-ansible/+/870804

Change-Id: I0adbe0a6c39e11d7c9542569085fc5d580f26c9d
2023-01-26 17:52:00 -06:00
Zuul
38ccebb8cb Merge "Add systemd container control" 2023-01-25 18:43:47 +00:00
Zuul
99d1e3c710 Merge "Adding optional delay between l3 agent restarts" 2023-01-25 14:08:06 +00:00
Zuul
cab09e31dc Merge "Add ability to configure rabbitmq" 2023-01-25 11:20:23 +00:00
Alex-Welsh
391aa4677f Adding optional delay between l3 agent restarts
This change serialises the neutron l3 agent restart process and adds a
user configurable delay between restarts. This can prevent connectivity
loss due to all agents being restarted at the same time.

Routers increase the recovery time, making this issue more prevalent.

Change-Id: I3be0ebfa12965e6ae32d1b5f13f8fd23c3f52b8c
2023-01-23 09:14:59 +00:00
Stanislav Dmitriev
0b62db7cc4 Set scheduler.max_attempts for nova conductor
In order to honour configured max number of attempts
it has to be presented in nova.conf inside of
nova_conductor container, otherwise the default value
of 3 will be used

Closes-Bug: #2003587
Change-Id: I928af332b8658223444594f96417830233057284
2023-01-20 17:10:52 -05:00
Zuul
32dce70f09 Merge "Drop skydive" 2023-01-19 10:26:01 +00:00
Martin Hiner
4866017e52 Add systemd container control
This commit adds SystemdWorker class to kolla_docker ansible module.
It is used to manage container state via systemd calls.

Change-Id: I20e65a6771ebeee462a3aaaabaa5f0596bdd0581
Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com>
Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>
2023-01-19 10:38:41 +01:00
Zuul
08267a59ce Merge "Stop firewalld config during kolla genconfig" 2023-01-18 16:26:19 +00:00