Many tasks that use Docker have become specified already, but
not all. This change ensures all tasks that use the following
modules have become:
* kolla_docker
* kolla_ceph_keyring
* kolla_toolbox
* kolla_container_facts
It also adds become for 'command' tasks that use docker CLI.
Change-Id: I4a5ebcedaccb9261dbc958ec67e8077d7980e496
Several config file permissions are incorrect on the host. In general,
files should be 0660, and directories and executables 0770.
Change-Id: Id276ac1864f280554e98b937f2845bb424d521de
Closes-Bug: #1821579
Reconfiguring Swift currently fails to restart containers if
configuration changes. This is because kolla_set_configs is executed in
the containers as the default swift user, which does not have permission
to access all necessary files.
This change uses the root user to execute the command instead, which
allows it to exit with the correct status of 1 if the config files
differ.
Change-Id: I2a2363c71430a7173bb5253662412ae5dba09654
When adding the rolling upgrade support, some upgrade procedures were
modified to pull images explicitly. This is done inconsistently between
services, and is a change in behaviour from Rocky and earlier releases.
This change removes all image pulling from upgrade tasks.
Change-Id: Id0fed17714235e1daed60b83b1f30620f097eb97
Adds support to seperate Swift access and replication traffic from other storage traffic.
In a deployment where both Ceph and Swift have been deployed,
this changes adds functionalality to support optional seperation
of storage network traffic. This adds two new network interfaces
'swift_storage_interface' and 'swift_replication_interface' which maintain
backwards compatibility.
The Swift access network interface is configured via 'swift_storage_interface',
which defaults to 'storage_interface'. The Swift replication network
interface is configured via 'swift_replication_interface', which
defaults to 'swift_storage_interface'.
If a separate replication network is used, Kolla Ansible now deploys separate
replication servers for the accounts, containers and objects, that listen on
this network. In this case, these services handle only replication traffic, and
the original account-, container- and object- servers only handle storage
user requests.
Change-Id: Ib39e081574e030126f2d08f51de89641ddb0d42e
This allows swift service endpoints to use custom hostnames, and adds the
following variables:
* swift_internal_fqdn
* swift_external_fqdn
These default to the old values of kolla_internal_fqdn or
kolla_external_fqdn.
This also adds a swift_proxy_server_listen_port option, which defaults to
swift_proxy_server_port for backward compatibility.
This option allow the user to differentiate between the port the
service listens on, and the port the service is reachable on. This is
useful for external load balancers which live on the same host as the
service itself.
While we're in here, use the ``internal_protocol`` variable for the swift
endpoint in cinder's swift backup driver configuration, instead of hardcoding
to ``http``.
Change-Id: Ibc01618383c26e16c0067f7f6b9cf5160d968d1e
Implements: blueprint service-hostnames
We're duplicating code to build the keystone URLs in nearly every
config, where we've already done it in group_vars. Replace the
redundancy with a variable that does the same thing.
Change-Id: I207d77870e2535c1cdcbc5eaf704f0448ac85a7a
With this change, an operator may be able to stop a
service container without stopping all services in a host.
This change is the starting point to start
fast-forward upgrades support.
In next changes new flags will be introducced to disable
stop dataplane services during upgrades.
Change-Id: Ifde7a39d7d8596ef0d7405ecf1ac1d49a459d9ef
Implements: blueprint support-stop-containers
Apply Swift rolling upgrade based on recommendations from Swift PTL John
Dickinson at [1]
[1] https://www.swiftstack.com/blog/2013/12/20/upgrade-openstack-swift-no-downtime/
Co-Authored-By: Surya Prakash <singh.surya64mnnit@gmail.com>
Change-Id: I99f505438916be2f89b24df20506339604e5bd6e
Implements: blueprint apply-service-upgrade-procedure
Having all services in one giant haproxy file makes altering
configuration for a service both painful and dangerous. Each service
should be configured with a simple set of variables and rendered with a
single unified template.
Available are two new templates:
* haproxy_single_service_listen.cfg.j2: close to the original style, but
only one service per file
* haproxy_single_service_split.cfg.j2: using the newer haproxy syntax
for separated frontend and backend
For now the default will be the single listen block, for ease of
transition.
Change-Id: I6e237438fbc0aa3c89a3c8bd706a53b74e71904b
The rsync prior to v3.1.0 the uid/gid parameter have no effect at
all if it runs as normal(non-root) user.
Since v3.1.0 these parameter are problematic for normal user
because now rsync, regardless of root or non-root, if the
parameters are given then it just tries to call setgroups() which
is not possible for normal user so errors may occur.
swift-object-replicator: @ERROR: setgroups failed\u0000
swift-object-replicator: rsync error: error starting
client-server protocol (code 5) at main.c(1648)
[sender=3.1.2]\u0000
Either way, these parameters are not needed for swift-rsync
container.
Change-Id: Ia7fe9f06d7a21a55f52b90c2cc1b2498300e6532
Signed-off-by: Minho Ban <mhban@samsung.com>
The authtoken config variable delay_auth_decision must be set to True.
The default is False, but that breaks public access, StaticWeb, FormPost,
TempURL, and authenticated capabilities requests (using Discoverability).
Change-Id: I420a95f5f9fda3321a4acfc5846e40294a8bd588
Closes-Bug: #1768795
The log_level in Swift is fixed to INFO. The patch make it changeable
according to the value of "openstack_logging_debug".
When "openstack_logging_debug" is "False", the log_level is set to
"INFO". It is default value. Otherwise, the log_level is set to
"DEBUG".
Closes-Bug: #1777982
Change-Id: I62f430abd8f332cc2ece56a6733776fa03b10f77
Signed-off-by: tone.zhang <tone.zhang@arm.com>
Add become to all tasks that use the module "kolla_docker"
Change-Id: I4309c4011687b88ec31d739fd8f834fe2326ff10
Partial-Implements: blueprint ansible-specific-task-become
- rename action and serial to kolla_ansible and kolla_serial
- use become instead of "sudo <command>" in shell
- Remove quota for failed_when and changed_when in rabbitmq tasks
Change-Id: I78cb60168aaa40bb6439198283546b7faf33917c
Implements: blueprint migrate-to-ansible-2-2-0
The mount is "rprivate" by default, change this to "shared"
such that mount points will dynamically propagate.
Closes-Bug: #1767828
Change-Id: If3b99bd1626a44aa7b41cf7d50d67b4fc9634462
- remove uesless module_extra_vars, this is a historical issue. In the
past, we use 'docker exec kolla_toolbox ansible xxx' to run module on
target node, so complex data have to pass through extra_vars. Now we
are using kolla_toolbox module, no need to use extra_vars anymore.
- Remove some useless until.
Change-Id: I72ed28001202917f9a82a1c3ea33cd6319911ec8
Swift configuration needs container and account quotas to
pass 'OpenStack Powered' certification test suite
Co-Authored-By: Alexander Reunov <alexander.reunov@oracle.com>
Change-Id: I7a31315754cbb46257d3d98379daa39d32205480
Closes-Bug: #1757451
This is required for some tempest tests and in turn to achieve 100%
refstack certification for clouds deployed by Kolla. tempurl is default in
Swift[0] but we're missing as we override the pipeline.
[0] https://github.com/openstack/swift/blob/\
b86bf15a644db4438770801a312fe074a09c91ef/\
etc/proxy-server.conf-sample#L97
Change-Id: I0e36fcd7a785f878005d51159eb51725c284229c
In the previous patch to address broken replication in Swift the account
and container replicators were missed.
Change-Id: I34a58b137dbba99c66e7680546fe85e2ef6131e9
Co-Authored-By: Thorsten Frueauf <thorsten.frueauf@oracle.com>
Partial-Bug: #1733851
There are corresponding image changes to go with these ansible
changes - changes in rsyncd template, and add
environment settings for RSYNC_CONNECT_PROG (i.e. nc)
nc allows for rsync replication to easily target {{ swift_rsync_port }}
update the lock file and chroot settings in template - see bug
for more details.
Change-Id: Ic81b7de8fad8aec9416e4e27e8ffda6d03be293c
Closes-Bug: #1733851
This commit separates the messaging rpc and notify transports in order
to support separate and different oslo.messaging backends
This patch:
* add rpc and notify variables
* update service role conf templates
* add example to globals.yaml
* add release note
Implements: blueprint hybrid-messaging
Change-Id: I34691c2895c8563f1f322f0850ecff98d11b5185
Object versioning is necessary to pass DefCore test suite,
i.e. allows Kolla version of OpenStack to be certified
as "OpenStack Powered Platform".
Change-Id: Id5003f7fe2aebdeffe1cf7ce1b6177a6bca8f5b6
Co-Authored-By: Alexander Reunov <alexander.reunov@oracle.com>
Closes-Bug: #1729583
When deploying on debian, it reports error:
stat /usr/bin/ansible: no such file or directory
That's because on Debian and Ubuntu pip install ansible to
/usr/local/bin/ansible, whereas on CentOS the location is
/usr/bin/ansible.
Change to ansible to handle both cases.
Closes-Bug: #1729216
Depends-On: I2b57403128bc103148ae696c219df52590214adc
Change-Id: I025037cf48596450e6479ab7ff6425c48ac73aad
Signed-off-by: Xinliang Liu <xinliang.liu@linaro.org>
When deploying with tls enabled in public
endpoints, ansible modules fails due SSL certificates
are self-signed.
This change adds a new variable to allow customization
on which endpoints ansible should connect.
Defaults to admin because admin auth parameters defaults
to admin endpoint.
Change-Id: Ic3ed58cf9c9579cae08a11bbfe6fce983b5a9cbc
Closes-Bug: #1720995
This change adds enable_fluentd option and enables some other log shippers
to be integrated. When enable_fluentd is "no", syslog server is also disabled.
Then, this change also adds syslog parameters to use a syslog server
prepared by users.
Change-Id: I7c83ef7fe30a6b9ab7385bcee953ad07e96b0a83
Implements: blueprint fluentd-enable-option
In order to speed up deployment time some "local" actions should be run
only once using 'run_once: True'.
This will decrease deployment time in case of multihost configuration.
Change-Id: I6015d772d35c15e96c52f577013b6e41197cb41a
ResellerAdmin role should be created always when Swift is enabled
and not only for Ceilometer. The role is needed for normal users
to get administration rights for their Swift projects and is
required to pass DefCore (OpenStack Powered) certification.
Change-Id: I4faa63b8fae1814e382de2794301248cc0f4a90a
Closes-Bug: #1700729
Ansible task support vars directive, no need implement another one in
merge_config. This patch remove the vars directive in merge_config
action plugin.
Change-Id: I33648a2b6e39b4d49ce76eb66fbf2522721f8c68
In case Kolla's users want to deploy with both of
binary and source image, we should have a variable
install type that define install type for each project.
We also add specific image tag for each Openstack project.
This commit is implemented for Sahara, Searchlight,
Senlin, Solum and Swift projects.
Change-Id: I964796b2f9e3eae69d7eccf68e9428ce9390010c
Implements: blueprint mixing-binary-and-source-image
