13064 Commits

Author SHA1 Message Date
Marcin Juszkiewicz
67607c679e Add CentOS Stream 9 / Rocky Linux 9 host support
Added c9s jobs are non voting, as agreed on PTG to focus on Rocky Linux 9.
Since both CS9 and RL9 have higher default fd limit (1073741816 vs
1048576 in CS8) - lowering that for:
* RMQ - because Erlang allocates memory based on this (see [1], [2], [3]).
* MariaDB - because Galera cluster bootstrap failed

Changed openvswitch_db healthcheck, because for unknown reason
the usual check (using lsof on /run/openvswitch/db.sock) is hanging
on "Bad file descriptor" (even with privileged: true).

[1]: https://github.com/docker-library/rabbitmq/issues/545
[2]: https://github.com/rabbitmq/cluster-operator/issues/959#issuecomment-1043280324
[3]: a8b627aaed

Depends-On: https://review.opendev.org/c/openstack/tenks/+/856296
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/856328
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/856443
Needed-By: https://review.opendev.org/c/openstack/kolla/+/836664
Co-Authored-By: Michał Nasiadka <mnasiadka@gmail.com>
Change-Id: I3f7b480519aea38c3927bee7fb2c23eea178554d
2022-09-08 16:33:25 +00:00
Zuul
a914b6668d Merge "Enable TLS in Bifrost" 2022-09-07 15:46:55 +00:00
Zuul
0411ff3bb4 Merge "Allow exposing OpenStack exporter via HAProxy" 2022-09-07 09:10:14 +00:00
Zuul
ee7aead860 Merge "mariadb: Add reuseaddr to socat execution" 2022-09-07 07:49:04 +00:00
Zuul
1d8c584dc3 Merge "Fix Hashi login method for approles" 2022-09-06 13:39:33 +00:00
Zuul
d8b81095c5 Merge "cephadm: Bump used Ceph to Quincy" 2022-09-06 11:26:54 +00:00
Michal Nasiadka
5d4e38072d mariadb: Add reuseaddr to socat execution
Sometimes in CI we're seeing Address already in use on clustercheck restarts.
Adding reuseaddr that allows immediate restart of the server process.

Change-Id: Ib1c9dcf99381b6b9d1095f450d74c797d39f4cb2
2022-09-06 12:57:56 +02:00
Michal Nasiadka
d1881c9b52 cephadm: Bump used Ceph to Quincy
Change-Id: If6c7bcb6a2b5017797caeb34f89f5341c54be6dc
2022-09-06 08:19:56 +00:00
Stig Telfer
ffb4767c05 Increase the Fluentd request timeout for ES
Fluentd has a default timeout of 5s for flushing data to ElasticSearch.
If there is a significant backlog of unsent log messages, this timeout
can be exceeded, resulting in Fluentd failing to make further progress.

Raise the default timeout to 60s.

This patch adopts the configuration parameters previously proposed by
Krzysztof Klimonda.

Closes-Bug: #1983031
Closes-Bug: #1896611
Change-Id: I1aaab654a5a0752fccef2cfb8cc0bde4a0ee2562
2022-09-05 10:33:16 +00:00
Scott Solkhon
3300815529 Fix Hashi login method for approles
Moves Hashi Vault client login to use `auth.approle.login` as
current method is being deprecated in the next release.

```
DeprecationWarning: Call to deprecated function 'auth_approle'.
This method will be removed in version '0.12.0' Please use
the 'login' method on the 'hvac.api.auth_methods.approle'
class moving forward.
client.auth_approle(vault_role_id, vault_secret_id)
```

Change-Id: Ie5c1ebe99c8508336cc10944fdaa742ad7d1d85e
2022-09-02 16:42:15 +01:00
Zuul
b0dc2423bc Merge "Upgrade openEuler Distro" 2022-09-01 08:13:16 +00:00
Zuul
6c3513f4f4 Merge "[TrivialFix] Fix task name in Ironic config" 2022-08-31 18:07:08 +00:00
Franco Mariotti
7219279215 Allow exposing OpenStack exporter via HAProxy
Signed-off-by: Franco Mariotti <fmariotti@whitestack.com>
Change-Id: Ie151cd97d3e0ba3bfec9e95a5b8bdfef0b54806c
2022-08-31 13:29:02 -03:00
Radosław Piliszek
5c58ea8f6a [CI] Run the cells scenario on Ubuntu
With CentOS-based jobs disabled, we don't have any job testing the
cells scenario. This patch adds it for Ubuntu.

Change-Id: Ic872242717006085f4dc586b0aea0e068f064a4b
2022-08-31 06:56:40 +00:00
Zuul
41803729f3 Merge "keystone: Remove redundant 'when'" 2022-08-30 19:36:45 +00:00
Zuul
b6f9c1c492 Merge "Fix haproxy prechecks after deployment" 2022-08-30 19:36:42 +00:00
Zuul
490cb977c2 Merge "[security] Make Ironic tftpd run as nobody" 2022-08-30 19:35:07 +00:00
Zuul
5eb81ca2a9 Merge "Fix creation of prometheus user and grant permissions" 2022-08-30 17:18:36 +00:00
Michal Arbet
c5500bdfd2 Fix creation of prometheus user and grant permissions
Prometheus is creating user and granting permissions
to database from which is gathering metrics. This
process is different when haproxy/proxysql is used.

Proxysql:

  - kolla-ansible should use root_shard_ID user to connect
    to ProxySQL endpoint and it is routed to proper shard.

Haproxy:

  - kolla-ansible should use root user to connect to HAProxy
    endpoint and that's all.

If proxysql is not used, mariadb role will not create user
shard_root_ID user in bootstrap (from my perspective of view
it should), and therefore it will fail when HAProxy is used.

This patch is just fixing user to connect.

Change-Id: Icd07807b2c404eb4d3f398879639b17f1e7949c2
2022-08-30 15:37:04 +02:00
Radosław Piliszek
a3d8e88fee Fix haproxy prechecks after deployment
HAProxy prechecks could fail if the ansible_user was not allowed
to access Docker API.

Change-Id: I09bfa35392bed77321d2de2424e44e60b60a8451
2022-08-29 16:43:45 +00:00
Pierre Riteau
b8928ce54b Switch Prometheus Alertmanager to active/passive
Closes-Bug: #1987866
Change-Id: Iaf352a15b9e6c9607e0d33c803c132d9267ca727
2022-08-29 18:25:52 +02:00
Pierre Riteau
f7b1221032 Use active_passive parameter for existing services
MariaDB is left unchanged because its custom_member_list uses a
different group (mariadb_default_database_shard_hosts).

Change-Id: Icefd5a3d02ae4dfeb27401696c35ca2c38e203d3
2022-08-29 14:38:02 +02:00
LinPeiWen
aa80f81d30 keystone: Remove redundant 'when'
In a multi-controller node, the presence of "run_once: True"
and "when: inventory_hostname == groups['keystone'][-1]"
will cause the task to be skipped

Closes-Bug: #1987982

Change-Id: I6a8f4ca285cda0675711b631aeed7ae4c992d879
2022-08-29 19:42:05 +08:00
Pierre Riteau
438ff2307c Support configuring HAProxy services as active/passive
Instead of specifying a custom member list for each service that should
be configured as active/passive, a new `active_passive` parameter can be
set to true. This only works if `custom_member_list` is not used.

Change-Id: I3758bc2377c25a277a29f02ebc20c946c7499093
2022-08-29 12:01:18 +02:00
Radosław Piliszek
37d9cf0d19 [CI] Drop bindep
It is not necessary and it may be confusing.

Change-Id: If7a727861883efcae55bb70eb9c223a5870f9a4f
2022-08-27 20:00:11 +00:00
Radosław Piliszek
f1d27f7ddb [security] Make Ironic tftpd run as nobody
This avoids root privileges in tftpd's unprivileged container.

Change-Id: I50366205c9cefe2af26c27580c02368f029b7605
2022-08-26 21:48:54 +02:00
Radosław Piliszek
209ba365cc [TrivialFix] Fix task name in Ironic config
Change-Id: I6b03d7ec0eb84c9a2544c2ad13102028452c2ec1
2022-08-26 11:05:34 +02:00
Radosław Piliszek
8b35f2738b [docs] Fix OVS link
Change-Id: I0746dc2d8bbdf9edf06d63407da46b7c63212a0c
2022-08-25 11:52:37 +02:00
Zuul
04fbc5e84b Merge "Persist Bifrost's autogenerated passwords" 2022-08-24 09:33:17 +00:00
Zuul
89c3a92066 Merge "Add api_workers for each service to defaults" 2022-08-22 15:30:33 +00:00
Michal Arbet
63d72ea7e8 Use Docker healthchecks for mariadb-server service
This change enables the use of Docker healthchecks for
mariadb-server service.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/805613
Change-Id: I893687a0501ea0f281b879df3141a354bff9eca6
2022-08-22 08:27:28 +00:00
wangxiyuan
bafdab171d Upgrade openEuler Distro
openEuler 20.03 LTS SP2 is out of date. This patch:
1. Upgrade openEuler to 22.03 TLS for host OS.
2. Switch guest OS from centOS 8 to ubuntu

Change-Id: If2ff036e965def141f67240945802611e1f4dc4e
2022-08-22 00:51:19 +00:00
Zuul
7c36bbfa00 Merge "Remove the deprecated storage_interface var" 2022-08-15 09:54:58 +00:00
Piotr Parczewski
09adcf0181 Add prometheus-msteams to get container facts loop
A follow up patch to I563f2438b3cb0895606b029b5269ce2e50c413e3

Change-Id: I1e4c5db46413668d4b5df2f2dcedc5d9aaecd63a
2022-08-12 07:34:27 +00:00
Zuul
6cab1fcbd0 Merge "Add support for deploying prometheus-msteams" 2022-08-10 17:14:13 +00:00
Zuul
1e5c54b234 Merge "[CI] Test ProxySQL with shards in the nova cells scenario" 2022-08-10 12:22:52 +00:00
Zuul
46059884f4 Merge "Add proxysql-config role and wrap it in loadbalancer-config role" 2022-08-10 12:22:49 +00:00
Zuul
2452a69806 Merge "Add loadbalancer-config role and wrap haproxy-config role inside" 2022-08-10 12:15:04 +00:00
Zuul
afec4d5656 Merge "Edit services roles to support database sharding" 2022-08-10 12:15:00 +00:00
Pierre Riteau
c1155a2879 Add support for deploying prometheus-msteams
This can be used to forward Prometheus Alertmanager notifications to
Microsoft Teams.

Change-Id: I563f2438b3cb0895606b029b5269ce2e50c413e3
Depends-On: https://review.opendev.org/c/openstack/kolla/+/812678
2022-08-10 13:21:41 +02:00
Zuul
8ef21123ae Merge "Honour the linuxbridge experimental status" 2022-08-09 14:21:21 +00:00
Zuul
981699f554 Merge "Add clouds.yaml file and use it" 2022-08-09 13:14:55 +00:00
Michal Arbet
1b3fcfed64 [CI] Test ProxySQL with shards in the nova cells scenario
There are two shards:
One 2-node (to test the clustering), one 1-node.

Change-Id: If3a60ad4cc39d6ad0cd72a934f5f7497cd44021b
Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>
2022-08-09 12:16:43 +02:00
Michal Arbet
ae7f4ddc3e Add proxysql-config role and wrap it in loadbalancer-config role
This patch ads proxysql-config role
which is used for generating users and
rules configuration.

Change-Id: I1fcb0e8040ea55f8f6b8384a56479eabdaf61c33
2022-08-09 12:16:16 +02:00
Michal Arbet
4838591c6c Add loadbalancer-config role and wrap haproxy-config role inside
This patch adds loadbalancer-config role
which is "wrapper" around haproxy-config
and proxysql-config role which will be added
in follow-up patches.

Change-Id: I64d41507317081e1860a94b9481a85c8d400797d
2022-08-09 12:15:49 +02:00
Michal Arbet
baad47ac61 Edit services roles to support database sharding
Depends-On: https://review.opendev.org/c/openstack/kolla/+/769385
Depends-On: https://review.opendev.org/c/openstack/kolla/+/765781

Change-Id: I3c4182a6556dafd2c936eaab109a068674058fca
2022-08-09 12:15:26 +02:00
Zuul
c31471fa84 Merge "loadbalancer: ignore missing keepalived container" 2022-08-08 12:39:52 +00:00
Monty Taylor
73a1812c58 Add clouds.yaml file and use it
clouds.yaml[0] is a richer way to express configuration for OpenStack
clouds. It's also fully supported by Ansible's OpenStack modules as
well as python-openstackclient and openstacksdk. It's the future - who
doesn't like the future?

Write a file using both the public (default) and the internal endpoints
for the admin user. Also, change all of the examples to reference it
and to get python-openstackclient to use it too.

[0] https://docs.openstack.org/openstacksdk/latest/user/guides/connect_from_config.html

Implements: blueprint use-clouds-yaml
Change-Id: I557d2e4975c7b3d3c713a556b9ba47af9567ce6e
2022-08-08 12:19:47 +00:00
Zuul
e2d276cd96 Merge "cephadm: Use distro-provided Quincy on Jammy" 2022-08-05 16:35:47 +00:00
Michal Nasiadka
532b81d6ee cephadm: Use distro-provided Quincy on Jammy
Ubuntu Jammy will only support Ceph Quincy.
Workaround for now - use Jammy in-distro packages for cephadm.

Change-Id: I30f071865b9b0751f1336414a0ae82571a332530
2022-08-05 13:48:31 +00:00