13849 Commits

Author SHA1 Message Date
Pierre Riteau
6ac502ec20 Fix typo in release note
Change-Id: I2f6cd19b7f4d3954bf9de17e6095d39545fe05d3
2024-03-01 09:30:12 +01:00
Zuul
06e39af796 Merge "Adds feature flag for ironic-inspector in bifrost" 2024-02-29 17:05:13 +00:00
Zuul
d42cdef420 Merge "Add password rotation docs page" 2024-02-29 11:37:52 +00:00
Will Szumski
4d40c9e68f Adds feature flag for ironic-inspector in bifrost
This is useful for backwards compatability.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/909865
Change-Id: Ib2936580db5e7ab3479722bc353c39063010b5f2
2024-02-28 14:59:29 +00:00
Zuul
e513ddd982 Merge "Adjust Ceph metrics scrape interval in Prometheus" 2024-02-27 11:59:32 +00:00
Zuul
ce3a6aff09 Merge "Fix gnocchi-metricd when TLS and Swift enabled" 2024-02-21 16:02:52 +00:00
Alex-Welsh
d6d82e2a88 Add password rotation docs page
Closes-Bug: #1793323
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/903178
Depends-On: https://review.opendev.org/c/openstack/kolla/+/902057
Change-Id: Ibebd6e04de215e1a1aaff52c55d28c4741af98f2
2024-02-21 12:02:34 +00:00
Zuul
d30fb56c2a Merge "Remove the grafana volume" 2024-02-20 17:25:50 +00:00
Zuul
ff63af4e65 Merge "cinder: Stop using admin service token" 2024-02-20 14:24:34 +00:00
Zuul
3c77151225 Merge "Revert "Disable new defaults and scope for Ironic (RBAC)"" 2024-02-19 12:43:31 +00:00
Zuul
311fd881e4 Merge "Template system scoped admin-openrc and clouds.yml files" 2024-02-19 12:40:06 +00:00
Zuul
33129b7554 Merge "Add service role to ironic service users" 2024-02-19 12:40:03 +00:00
Zuul
a6fa564499 Merge "Ironic: enable elevated access for project scoped service role" 2024-02-19 12:40:00 +00:00
Zuul
a3f3dc7ab5 Merge "CI: Change prometheus jobs to voting and gating" 2024-02-15 19:23:39 +00:00
Bartosz Bezak
c51fbfdd8b Revert "Disable new defaults and scope for Ironic (RBAC)"
This reverts commit d77372e86ab078711d48dbe2917714f338842ca5.

Reason for revert: service role support has been fixed in Ironic [1]
and added to Kolla-Ansible.

[1] https://review.opendev.org/c/openstack/ironic/+/907148

Closes-Bug: #2051837

Change-Id: I49664e3a353f54e0d51f454c552a78846ba64101
2024-02-15 15:14:56 +00:00
Bartosz Bezak
6e835ae758 Template system scoped admin-openrc and clouds.yml files
Ironic enabled secure RBAC with system scoped enforcement [1].

Some API calls, for instance 'baremetal:driver:get' needs system
scope role by design [2], even with elevated access project scope
service role [3].

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] 8ec5606622/ironic/common/policy.py (L1349-L1357)
[3] https://review.opendev.org/c/openstack/kolla-ansible/+/908007

Related-Bug: #2051837

Change-Id: Id6313d7dd343b82d4c9ccf7bf429d340ea0e93d1
2024-02-15 15:01:59 +00:00
Zuul
0701436fd2 Merge "CI: Fix prometheus-opensearch-upgrade CI job" 2024-02-15 14:57:34 +00:00
Zuul
0dac9eb93d Merge "Fix mariadb role when used with check mode" 2024-02-15 14:13:18 +00:00
Bartosz Bezak
600e912400 Add service role to ironic service users
Add the service role to ironic service users. Ironic recently enforced
new policy validation as part of the RBAC efforts. [1][2]
Service user support was also added to Ironic. [3]
Admin role needs to stay as not all services added service role support. [4][5]

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] e2a47de10a/goals/selected/consistent-and-secure-rbac.rst (phase-2)
[3] https://review.opendev.org/c/openstack/ironic/+/907148
[4] https://review.opendev.org/q/topic:bp%252Fpolicy-service-role-default
[5] https://review.opendev.org/q/topic:%22New-Location-Apis%22

Related-Bug: #2051837
Change-Id: I048402c2247188cf57f35437f557f84ac25d4ff2
2024-02-15 14:05:52 +00:00
Bartosz Bezak
121aa3d258 Ironic: enable elevated access for project scoped service role
Ironic recently started to enforce new policies and scope [1].
And Ironic is one of the sole openstack project which need
system scope for some admin related api calls [2].
However Ironic also started to allow project-scope behaviour
for service role with setting
``rbac_service_role_elevated_access``[3] [4]. This change enables
this setting to get similar behaviour of service role as other
openstack projects.

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] e2a47de10a/goals/selected/consistent-and-secure-rbac.rst (L261)
[3] https://review.opendev.org/c/openstack/ironic/+/907148
[4] 8ec5606622/releasenotes/notes/service-project-service-role-fix-e4d1a8c23856926a.yaml

Related-Bug: #2051837

Change-Id: If8d7cf1663145d0398a2e936486e2b316d4df5e0
2024-02-15 15:04:06 +01:00
Michal Nasiadka
1ef765f690 cinder: Stop using admin service token
In order to do this - we need to add service role to Nova and Cinder.

Closes-Bug: #2049762

Change-Id: Ic121bf9f90c9865cd4d08890c80247570ef310ae
2024-02-15 12:07:39 +00:00
Michal Nasiadka
7d897399f0 CI: Change prometheus jobs to voting and gating
Change-Id: I5bc50e390d0b8100a1b6bf5bd5c8b6ecdeb7cd6c
2024-02-15 10:59:38 +00:00
Doug Szumski
afa202e259 CI: Fix prometheus-opensearch-upgrade CI job
The upgrade job needs the haproxy exporter group, which
was missing from the inventory.

Change-Id: Ie4ecf283a2f4ac056ace5e76f2acc4ba1a8fe0b4
2024-02-15 10:59:34 +00:00
Michal Nasiadka
63cf525af5 CI: Increase RADOS timeout for cephadm jobs
Default timeout is 5 and we're often hitting that on our poor man's
Ceph.

Change-Id: Ide92b3c32150c0045b0723155f94b21ea9cdce66
2024-02-14 10:02:35 +00:00
Michal Nasiadka
fe155496e1 CI: Switch cephadm jobs to redis
etcd is flakey and complaining over slow disk

Change-Id: I1f5191015b53bdb218cfeaa43586ecf2d71a161e
2024-02-13 12:46:23 +01:00
Dawud
8962b4081e
Remove the grafana volume
Fixes not being able to add additional plugins at build time due to the
`grafana` volume being mounted over the existing `/var/lib/grafana`
directory. This is fixed by copying the dashboards into the container
from an existing bind mount instead of using the ``grafana`` volume.
This however leaves behind the volume which should be removed with
`docker volume rm grafana` or by setting `grafana_remove_old_volume` to
`True`.

Closes-Bug: #2039498
Change-Id: Ibcffa5d8922c470f655f447558d4a9c73b1ba361
2024-02-12 16:03:19 +00:00
Zuul
07bbf1707f Merge "[CI] Enable testing horizon" 2024-02-09 13:03:12 +00:00
Zuul
92286fa7ee Merge "Fix horizon deployment" 2024-02-09 12:57:33 +00:00
Zuul
23909f1b9e Merge "CI: Run SLURP upgrade job" 2024-02-09 10:41:54 +00:00
Zuul
35352a6be0 Merge "Rework horizon role to support local_settings.d" 2024-02-08 20:45:20 +00:00
Zuul
8ccdc1898e Merge "Rename horizon settings filenames" 2024-02-08 16:09:17 +00:00
Michal Nasiadka
09fb029569 CI: Run SLURP upgrade job
Change-Id: I246b14c9b547c6a0ff0be68ad57e723839cc3275
2024-02-08 13:13:35 +00:00
Zuul
54451a814b Merge "openvswitch: Set fail_mode to standalone for external bridges" 2024-02-08 11:38:15 +00:00
Michal Arbet
05462c471c [CI] Enable testing horizon
Change Ib7f72b2663199ef80844a412bc436c6ef09322cc
disabled horizon testing. This patch enabling
horizon tests again.

Change-Id: Iff670525c91c8adbcf2a01288b12456cb4a31809
2024-02-07 16:13:27 +01:00
Michal Arbet
4108aea879 Fix horizon deployment
New horizon release use [1] for cache backend
instead of [2] as it was in previous versions.

This patch:

1. Removes override from config and
   configure only memcached endpoints, not backend
   specification itself. This will avoid bugs
   in future in case BACKEND will be switched again.

2. Remove 'memcached' context from kolla_address filter
   and use 'url' as [1] don't support inet6:[{address}]
   for ipv6 but supports [{address}] which 'url' provides.

[1] django.core.cache.backends.memcached.PyMemcacheCache
[2] django.core.cache.backends.memcached.MemcachedCache

Change-Id: Ie3a8f47e7b776b6aa2bb9b1522fdd4514ea1484b
2024-02-07 16:13:27 +01:00
Michal Arbet
b5aa63dee1 Rework horizon role to support local_settings.d
This patch implements horizon's preferred way how
to configure itself described in docs [1],

[1] https://docs.openstack.org/horizon/latest/configuration/settings.html

Depends-On: https://review.opendev.org/c/openstack/kolla/+/906339
Change-Id: I60ab4634bf4333c47d00b12fc4ec00570062bd18
2024-02-07 16:13:26 +01:00
Michal Nasiadka
5016b3efaf openvswitch: Set fail_mode to standalone for external bridges
That is the ovs-vsctl default but Ansible module is failing in
reconfigure step - and secure breaks external connectivity in
OVN.

From OVS docs:
fail_mode: optional string, either secure or standalone

When  a controller is configured, it is, ordinarily, responsible
for setting up all flows on the switch. Thus, if the  connection
to  the  controller fails, no new network connections can be set
up. If the connection to the controller stays down long  enough,
no  packets can pass through the switch at all. This setting de‐
termines the switch’s response to such a situation.  It  may  be
set to one of the following:

standalone
    If  no  message is received from the controller for three
    times  the  inactivity  probe  interval   (see   inactiv‐
    ity_probe), then Open vSwitch will take over responsibil‐
    ity for setting up flows.  In  this  mode,  Open  vSwitch
    causes  the  bridge  to act like an ordinary MAC-learning
    switch. Open vSwitch will continue to retry connecting to
    the controller in the background and, when the connection
    succeeds, it will discontinue its standalone behavior.

secure 
    Open vSwitch will not set up flows on its  own  when  the
    controller  connection  fails  or when no controllers are
    defined. The bridge will continue to retry connecting  to
    any defined controllers forever.

The default is standalone if the value is unset, but future ver‐
sions of Open vSwitch may change the default.

Change-Id: Ica4dda2914113e8f8349e7227161cb81a02b33ee
2024-02-07 13:34:50 +00:00
Zuul
074d8b0ebf Merge "Enable HAProxy Prometheus metrics endpoint" 2024-02-07 10:33:24 +00:00
Zuul
53f2c582d9 Merge "Update keystone service user passwords" 2024-02-07 10:07:30 +00:00
Michal Arbet
d0b93a631d Fix mariadb role when used with check mode
This patch adds check_mode: false to tasks
in restart_services.yml which just checking
some WSREP status and if port is UP.

Closes-Bug: #2052501
Change-Id: I92a591900d85138a87991a18dd4339efd053ef1b
2024-02-06 10:39:34 +01:00
Zuul
1b96b89df0 Merge "openvswitch: use Ansible modules to set up bridge" 2024-02-06 09:02:34 +00:00
Zuul
e838c679ac Merge "reno: Update master for unmaintained/yoga" 2024-02-05 18:36:52 +00:00
de6878a819 reno: Update master for unmaintained/yoga
Update the yoga release notes configuration to build from
unmaintained/yoga.

Change-Id: I3ebb137938de8f9333c89173974656712e89c17f
2024-02-05 16:06:51 +00:00
Michal Nasiadka
90e9dc9e56 openvswitch: use Ansible modules to set up bridge
Change-Id: Iaf337c4a44bf065e96d6f30598e519ffc78de554
2024-02-05 15:24:55 +00:00
Michal Arbet
43272acfc3 Rename horizon settings filenames
The purpose of this patch is to make it easier to
review changes, because renaming and changing the
file in one patch will generate diff when the entire
file will be deleted on the one hand and new file
(actually just renamed) will be new on the other hand,
which is hard to review.

Change-Id: I17a16ce746faa8898a457cadbb6f996f964a5b6f
2024-02-05 14:36:55 +01:00
Michal Nasiadka
2830e42627 openvswitch: add external-ids:hostname
It's been introduced in [1] and seems to be used by ovn-controller.

[1]: https://patchwork.ozlabs.org/project/openvswitch/patch/1458866450-1967-1-git-send-email-russell@ovn.org/

Change-Id: I90e91f2923d58eb3c70e8d6efdc4e1212fbdc14f
2024-02-05 12:43:16 +00:00
Zuul
d0db5dc9fc Merge "Sync development quickstart doc" 2024-02-02 16:56:28 +00:00
Zuul
e7ffb3b85e Merge "Generate hostnqn" 2024-02-02 16:56:26 +00:00
Zuul
5cc1c68570 Merge "Remove outdated comments in dev mode docs" 2024-02-02 15:34:39 +00:00
Bartosz Bezak
fc439e74a8 Sync development quickstart doc
The development quickstart document has not been updated for a
while, and it has become desynchronized with the regular quickstart.

Change-Id: I6b14623b73b0032df94f0f633659a1b6dfc15dea
2024-02-02 16:11:35 +01:00