heat-api kept redirecting clients to use http:// instead of https://
when communicating with our https:// only loadbalancer
Please examine the logic for enabling it carefully, it's hard to know
if it should be enabled or not, potenitially it could be a security
risk.
Based on openstack-ansible-os_heat:
commit 4033a0f854cba6719c61812ef5b553e932a6c6c2
Author: Kyle L. Henderson <kyleh@us.ibm.com>
Enable oslo_middleware proxy header parsing
"Heat has moved to using oslo_middleware for the http proxy header
parsing, however the default is to not parse the headers. When
the external protocol differs from the internal protocol this
parsing is required in order for heat to work properly since it
will return 302 redirects to the client during some operations
(such as delete stack).
An example of this is when using haproxy with https configured
for the external protocol and http for the internal protocol.
If the oslo_middleware does not parse the headers, then any
302 redirects would specify a url with http rather than
correctly specifying https and the heat client would fail to
connect on the redirect url."
Change-Id: I38661a0bc2163a7f72febd98b7ae6f51c5d45ad5
We explicitly gather facts for all nodes up front in the playbook, so
setup tasks for all other plays are unnecessary noise.
Change-Id: I4bc152288752da780b5cb447b4ad3f7d49390dee
* Remove references to all-in-one, kolla Swift now works correctly in both
all-in-one and multinode contexts
* Fixup commands used for generating rings
* General readability improvements
Change-Id: I3ec87068a98ba5397bb6f2feb707bc685181e747
The check whether 'already' presents in mongodb output
should belong to changed_when.
Change-Id: Ib982a59820d53ccf5439f59df50c1b1938650967
Closes-Bug: #1641113
The wrapper keystone_bootstrap.sh expects to parse output from the
keystone-manage command. Somewhere along the line this command stopped
logging to stderr resulting in it not being able to report it's changed
status correctly.
Closes-Bug: #1668220
Change-Id: I895ebe11b88fd239fa8cb6e1a2fed779743e4139
The panko database type can be mongodb, so the panko container should
boot after mongodb
Change-Id: Ide3a90a4882197bf361c794dccccbc195b89e5bb
Closes-Bug: #1668206
- remove the unnecessary blank
- add "ironic_inspector" into its own prechecks and haproxy prechecks
Change-Id: Id542971057a9116eef679f1eb0827266eb18ba30
Closes-bug: #1668178
* Instruct the user that the VG needs to be on the storage nodes
* enable_cinder_backend_lvm needs to be enabled when following this
guide.
Change-Id: I252ec98c98493705417aaf197f703957cce8528f
There is not prechecks for Ironic kernel and initramfs files, this
patch add it.
Change-Id: I7e576eeff02310170d51a4585cbda6c465a29e0d
Closes-bug: #1667544
Setting up Magnum fails at creating and setting magnum's trustee
domain.
The changes this patch introduces follow.
- add registering trustee_domain
- remove unnecessary set_fact as this variable is used only once
Change-Id: I1c1ed8a20871fb4e9f153c6dd1431d9b6fd286a5
Closes-Bug: #1667209
New dashboard plugins are included in horizon,
new custom policies support need to be added for
those services.
Change conditional check to apply changes when
horizon plugin is enabled, not the service itself.
Closes-Bug: #1664505
Change-Id: I67fcb88fd432b4c7554ddf24e76b28c3aab7c01f
Most bootstrap actions use the run_once flag to run on a single host
as they typically involve service-global operations such as database
syncs. The ironic_pxe container bootstrap is different, as it copies
pxelinux files into the ironic_pxe Docker volume. This should be done
on all hosts but currently is only done on one host.
This change performs the ironic_pxe bootstrap on all hosts in the
ironic-pxe group.
Change-Id: Iffd34e6ff26a0ba5140e5d477418cc8aebcdac62
Closes-Bug: #1667153
The ironic_dnsmasq container is currently tied to the ironic-conductor
Ansible group. It is required only for Ironic inspector and should
really either be tied to the ironic-inspector group or have a new
ironic-dnsmasq group defined for it. This problem means that if all
hosts are removed from the ironic-inspector group I will still have an
ironic_dnsmasq container deployed.
This change uses the ironic-inspector group to determine where to place
the ironic_dnsmasq container.
Change-Id: I6af3f402795107b8b9d7a1619722f12cbf496257
Closes-Bug: #1666982
Currently the ironic_dnsmasq container does not support
reconfiguration. This change adds support for reconfiguration of
ironic_dnsmasq.
Change-Id: I7f121dca7d32e0b28c7531378dd0eef03ae4f1ce
Closes-Bug: #1667090
