656 Commits

Author SHA1 Message Date
Doug Szumski
505cded29b Support disabling Prometheus server
This is useful to people who manage their Prometheus Server
externally to Kolla Ansible, or want to use the exporters with
another framework such as Monasca.

Change-Id: Ie3f61e2e186c8e77e21a7b53d2bd7d2a27eee18e
2020-03-20 17:18:39 +00:00
Mark Goddard
bab770a88b CentOS 8: Use master image tag by default
While supporting both CentOS 7 and 8, we used the tag 'master-centos8'
for CentOS 8 images. We are now ready to drop CentOS 7 support, and
Kolla is switching to publish CentOS 8 images using the master tag on
the master branch, so we should use this.

Depends-On: https://review.opendev.org/713265

Partially-Implements: blueprint centos-rhel-8

Change-Id: I07d2c285e3214a6dc827a8e8eacf263048ee099b
2020-03-16 15:58:55 +00:00
Christian Berendt
77a1d27938 Remove enable_cadf_notifications variable
The variable enable_cadf_notifications is deprecated and marked
for removal during the U cycle.

Change-Id: I5e4d20d112db2392b55a0788f4d704ab6ca6112f
2020-03-06 13:40:43 +00:00
Zuul
19671fb3c7 Merge "[gnocchi] Disable statsd daemon by default" 2020-03-02 13:48:26 +00:00
Jason Anderson
5736500030
[gnocchi] Disable statsd daemon by default
This daemon is an additional piece of functionality supported by Gnocchi
and the general pattern in KA is to disable such things unless the user
explicitly wants them. This also helps avoid having to set the
resource_id, user_id, and project_id variables for Gnocchi if you don't
care about this daemon.

Change-Id: I5f14cee4b0bb0d781b1ff53200d11de972d20c82
2020-02-19 15:28:38 -06:00
Will Szumski
4cf7ff9fa2 Introduce influxdb_datadir_volume
This allows you to tune the performance of InfluxDB by locating the
volume on a drive that is separate to the default docker storage.

Change-Id: Iea555a2702b225b30f5d7035b8a703d4f3376ee7
2020-02-19 16:08:33 +00:00
Michal Nasiadka
ab3151d8f2 Fix swift entries in group_vars/globals.yml
Change-Id: I41c2fb7d476d553aeaca34feef1d045967c284fb
2020-02-13 15:33:13 +01:00
Michal Nasiadka
4e6fe7a6da Remove kolla-ceph
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1].

This change removes the Ansible code and associated CI jobs.

[1]: https://review.opendev.org/669214

Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
2020-02-11 11:42:06 +01:00
Zuul
4200089716 Merge "Generate self signed TLS certificates" 2020-02-07 17:33:49 +00:00
Zuul
b3c8ff59f1 Merge "Copy CA into containers." 2020-02-07 17:25:01 +00:00
Zuul
157acea6d5 Merge "CentOS 8: Deploy CentOS 8 containers" 2020-02-05 10:34:06 +00:00
Michal Nasiadka
fdf3729f83 External Ceph: add ceph_*_user variables
To make the configuration easier for the user, and to allow non-standard
ceph authentication ids - introduce ceph_*_user variables.

Change-Id: I24e01c43c826b62b6748d93a498f4b7d8ce9e309
2020-01-29 11:06:58 +00:00
James Kirsch
d100904f2c Generate self signed TLS certificates
Generate both internal and external self signed TLS certificates.
Duplicate the certificate if internal and external VIPs are the same.

Change-Id: I16b345c0b29ff13e042eed8798efe644e0ad2c74
Partially-Implements: blueprint custom-cacerts
2020-01-28 14:03:33 -08:00
James Kirsch
511ba9f6a2 Copy CA into containers.
When kolla_copy_ca_into_containers is set to "yes", the Certificate
Authority in /etc/kolla/certificates will be copied into service
containers to enable trust for that CA. This is especially useful when
the CA is self signed, and would not be trusted by default.

Partially-Implements: blueprint custom-cacerts

Change-Id: I4368f8994147580460ebe7533850cf63a419d0b4
2020-01-28 14:03:32 -08:00
Mark Goddard
3b24e566f6 CentOS 8: Deploy CentOS 8 containers
* HAProxy is now 1.8 in CentOS 8
* Support python3 in baremetal role
* Remove support for environments without python2 installed (this could
  not have worked since we gather facts before this point)

Workarounds:

* Using CentOS 7 yum repo for Docker, with module_hotfixes

Change-Id: I30bd3d58f6224ad4c9575ba66c74deabe6895cc4
Partially-Implements: blueprint centos-rhel-8
2020-01-28 16:46:41 +00:00
Zuul
13dea3f931 Merge "External Ceph: keys as variables" 2020-01-23 12:43:43 +00:00
Michal Nasiadka
1f929336e3 External Ceph: keys as variables
Introduce user modifiable variables instead of fixed-names
of Ceph keyring files for external Ceph functionality.

Change-Id: I1a33b3f9d6eca5babf53b91187461e43aef865ce
2020-01-22 18:16:38 +00:00
Mark Goddard
9755c924be CentOS 8: Support variable image tag suffix
For the CentOS 7 to 8 transition, we will have a period where both
CentOS 7 and 8 images are available. We differentiate these images via a
tag - the CentOS 8 images will have a tag of train-centos8 (or
master-centos8 temporarily).

To achieve this, and maintain backwards compatibility for the
openstack_release variable, we introduce a new 'openstack_tag' variable.
This variable is based on openstack_release, but has a suffix of
'openstack_tag_suffix', which is empty except on CentOS 8 where it has a
value of '-centos8'.

Change-Id: I12ce4661afb3c255136cdc1aabe7cbd25560d625
Partially-Implements: blueprint centos-rhel-8
2020-01-10 09:56:04 +00:00
Zuul
6dde7ce833 Merge "Adds monasca-ui to horizon" 2020-01-08 16:27:10 +00:00
Mark Goddard
350bb171ef Configure Cinder to use lioadm on CentOS/RHEL 8
In CentOS/RHEL 8 there is no scsi-target-utils package, nor is it
available in EPEL. It is removed from kolla in [1]. In RHEL 7 and beyond
the LIO kernel subsystem can be used instead of the tgtd daemon.

This change removes support for the SCSI target daemon on CentOS/RHEL 8.
The 'tgtd' image is no longer available for CentOS/RHEL 8.

[1] https://review.openstack.org/#/c/613815/5

Change-Id: I718fc16cde2dd177b2a1c2f79b932426034897fe
Related: blueprint centos-rhel-8
2020-01-08 10:39:54 +00:00
Hamed Bahadorzadeh
2eebf64275 Adds monasca-ui to horizon
Variable added to evaluate "ENABLE_MONASCA" env for 'kolla/horizon'. In
case 'enable_horizon_monasca' is true, 'policy_item' would be called for
Monasca.

Change-Id: Ie9ecb8ab5d4e74af9b83a5b00ccced5b630ab1ed
Implements: blueprint monasca-ui
Signed-off-by: Hamed Bahadorzadeh <h.bahadorzadeh@gmail.com>
2019-12-28 15:16:28 +03:30
Zuul
a46292f6b6 Merge "Support configuration of Docker client timeout" 2019-12-10 12:38:57 +00:00
Zuul
558b745ae1 Merge "Support deploying Elasticsearch Curator" 2019-12-10 10:52:46 +00:00
Doug Szumski
d4381456fd Support deploying Elasticsearch Curator
This allows users to supply an Elasticsearch Curator actions file
to manage log retention [1]. Curator then runs on a cron job, which
defaults to every day. A default curator actions file is provided,
which can be customised by the end user if required.

[1] https://www.elastic.co/guide/en/elasticsearch/client/curator/current/actionfile.html

Change-Id: Ide9baea9190ae849e61b9d8b6cff3305bdcdd534
2019-12-09 14:49:05 +00:00
Mark Goddard
01050dc01f Support configuration of Docker client timeout
Adds support for configuration of the Docker client timeout via
'docker_client_timeout'.

This change also increases the default timeout to 120 seconds, as we
sometimes see timeouts in CI and heavily loaded or underpowered
environments. Increasing 'docker_client_timeout' further may be helpful
in cases where Docker reports 'Read timed out'.

Change-Id: I73745771078cb2c0ebae2b1d87ba2c4c12958d82
Closes-Bug: #1809844
2019-11-28 10:10:00 +00:00
Zuul
e04d03e764 Merge "Default to disabling haproxy for memcached" 2019-11-25 10:30:48 +00:00
Michal Nasiadka
865ac24fc5 Remove Neutron integration with ONOS
Change-Id: Ie35ea07b8b6f95cbb56eb722ae2366c00243e562
2019-11-18 15:39:19 +00:00
Zuul
c4818ffd16 Merge "Remove OpenDaylight role" 2019-11-18 15:30:39 +00:00
Michal Nasiadka
eec6831fff Remove OpenDaylight role
Opendaylight support has been deprecated in Train - time to remove it.

Change-Id: I3a61bfbcbf366c327ea3e25d2424bc3fedca29f0
2019-11-18 11:57:32 +00:00
Zuul
d78472869d Merge "Set previous release to Train" 2019-11-15 11:59:24 +00:00
Mark Goddard
ad01556925 Remove enable_xtrabackup variable
This was deprecated in the Train release in favour of enable_mariadb.

Change-Id: Iea0c6eb51ff26817eeb913c9aa241a9fe7553588
2019-11-14 11:39:24 +00:00
Mark Goddard
d4f719e95a Set previous release to Train
Now that the stable/train branch has been cut, we can set the previous
release to Train. This is done in kolla-ansible for rolling upgrades,
and in CI configuration for upgrade tests.

Change-Id: I9d903543936e59aeeee939b32afce3e63b8c4394
2019-11-14 11:34:09 +00:00
Zuul
6160cdc576 Merge "Use mariabackup for database backups" 2019-11-04 12:10:42 +00:00
Mark Goddard
7f47ddf7f4 Use mariabackup for database backups
Currently, Xtrabackup is used for database backups. However, Xtrabackup
is not compatible with MariaDB 10.3. This change switches to use
mariabackup [1], which is available in the mariadb image.

The documented full and incremental restore procedures have been
modified to use mariabackup, following [2] and [3].

[1] https://mariadb.com/kb/en/library/mariabackup-overview/
[2] https://mariadb.com/kb/en/library/full-backup-and-restore-with-mariabackup/
[3] https://mariadb.com/kb/en/library/incremental-backup-and-restore-with-mariabackup/

Change-Id: Id52b9b1f7b013277e401b1f6b8aed34473d2b2c4
Closes-Bug: #1843043
Depends-On: https://review.opendev.org/691290
2019-11-01 18:44:10 +00:00
yuchengde
44a302d7d2 Allow nova to delete volume with cinder auth
If "reclaim_instance_interval" has been set in nova conf,
attched volume may not be delete while instacne deleted.
Adding cinder auth in nova conf can solve the problem.

Change-Id: I9eb3a74c2f6976043cc35a94915f1fcecb9ef601
Closes-Bug:  1850279
2019-11-01 14:48:37 +00:00
Radosław Piliszek
668463ef19 Default to disabling haproxy for memcached
Since at least the Rocky release we have been enabling
this needlessly.
The enable_haproxy_memcached parameter is not documented but it
can be kept as it is very light on maintenance.

Change-Id: I8b3a6a9f676d2d79657d859190198b17cc8e8a82
2019-10-24 09:09:45 +02:00
Radosław Piliszek
099a33c87d [train] Finish configuring Zun to use Placement
This also enables Placement when Zun is enabled like Kolla Ansible
already does with Nova.

Change-Id: Id2a09f702e8503b49d2b9e73e06b2ce9f4d168a9
Closes-bug: #1840573
2019-10-20 19:33:56 +02:00
Radosław Piliszek
4d398f4b7f Fix placement being enabled always instead of with nova
Adds "| bool".

Backportable to Stein.

Change-Id: Ifa2aa387be46beb6da1d3c5a5e0da1b561af8cee
Closes-bug: #1848937
2019-10-20 19:30:21 +02:00
Jan Vondra
e54edb55e4 Neutron: add support to use legacy iptables
neutron_legacy_iptables option sets the KOLLA_LEGACY_IPTABLES
environment variable in the neutron-l3-agent, neutron-linuxbridge-agent
and neutron_openvswich_agent container where it should be consumed
by kolla_extended_start script resulting in setting iptables-legacy.

Depends-On: https://review.opendev.org/#/c/683679/
Change-Id: Iaa8b46a2227b61a729b8d54bbe4b20f389f251d1
2019-10-17 09:42:00 +00:00
Doug Szumski
78a828ef42 Support multiple nova cells
This patch adds initial support for deploying multiple Nova cells.

Splitting a nova-cell role out from the Nova role allows a more granular
approach to deploying and configuring Nova services.

A new enable_cells flag has been added that enables the support of
multiple cells via the introduction of a super conductor in addition to
cell-specific conductors. When this flag is not set (the default), nova
is configured in the same manner as before - with a single conductor.

The nova role now deploys the global services:

* nova-api
* nova-scheduler
* nova-super-conductor (if enable_cells is true)

The nova-cell role handles services specific to a cell:

* nova-compute
* nova-compute-ironic
* nova-conductor
* nova-libvirt
* nova-novncproxy
* nova-serialproxy
* nova-spicehtml5proxy
* nova-ssh

This patch does not support using a single cell controller for managing
more than one cell. Support for sharing a cell controller will be added
in a future patch.

This patch should be backwards compatible and is tested by existing CI
jobs. A new CI job has been added that tests a multi-cell environment.

ceph-mon has been removed from the play hosts list as it is not
necessary - delegate_to does not require the host to be in the play.

Documentation will be added in a separate patch.

Partially Implements: blueprint support-nova-cells
Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: I810aad7d49db3f5a7fd9a2f0f746fd912fe03917
2019-10-16 17:42:36 +00:00
Radosław Piliszek
bc053c09c1 Implement IPv6 support in the control plane
Introduce kolla_address filter.
Introduce put_address_in_context filter.

Add AF config to vars.

Address contexts:
- raw (default): <ADDR>
- memcache: inet6:[<ADDR>]
- url: [<ADDR>]

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic multinode source CI job for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Remove neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working (also IPv4-only)

haproxy upgrade checks for slaves based on ipv6 addresses

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address
No idea whether ovs-dpdk works at all atm.

ml2 for xenapi
Xen is not supported too well.
This would require working with XenAPI facts.

rp_filter setting
This would require meddling with ip6tables (there is no sysctl param).
By default nothing is dropped.
Unlikely we really need it.

ironic dnsmasq is configured IPv4-only
dnsmasq needs DHCPv6 options and testing in vivo.

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: https://github.com/moby/moby/issues/39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname/FQDN

RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4.
This is due to old RabbitMQ versions available in images.
IPv4 is preferred by default and may fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.
Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will
no longer be relevant as we supply all the necessary config.
See: https://github.com/rabbitmq/rabbitmq-server/pull/1982

For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed
to work well). Older Ansible versions are known to miss IPv6 addresses
in interface facts. This may affect redeploys, reconfigures and
upgrades which run after VIP address is assigned.
See: https://github.com/ansible/ansible/issues/63227

Bifrost Train does not support IPv6 deployments.
See: https://storyboard.openstack.org/#!/story/2006689

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
2019-10-16 10:24:35 +02:00
Zuul
6bdd7dba75 Merge "[designate] Add coordination backend for designate workers" 2019-10-03 13:15:52 +00:00
Zuul
fc3cf24536 Merge "Add 'db=0' to redis_connection_string" 2019-10-02 10:03:15 +00:00
Joseph M
9cae608392 [designate] Add coordination backend for designate workers
Add coordination backend configuration to designate.conf which is
required in multinode environments. Fixes warning from designate:

WARNING designate.coordination [-] No coordination backend configured,
assuming we are the only worker. Please configure a coordination backend

Change-Id: I23c4d2de7e3f9368795c423000a4f9a6c3a431e2
Closes-Bug: #1843842
Related-Bug: #1840070
2019-09-30 11:02:27 -04:00
Mark Goddard
27f4876eed Switch default cloudkitty storage backend to influxdb
Backport: stein

In the Stein release, cloudkitty switched the default storage backend
from sqlalchemy to influxdb. In kolla-ansible stein configuration, we
did not explicitly set the storage backend, and so we automatically
picked up this change. However, prior to
https://review.opendev.org/#/c/615928/ we did not have full support for
InfluxDB as a storage backend, and so this has broken the Rocky-Stein
upgrade (https://bugs.launchpad.net/kolla-ansible/+bug/1838641), which
fails with this during the DB sync:

ERROR cloudkitty InfluxDBClientError: get_list_retention_policies()
requires a database as a parameter or the client to be using a database

This change synchronises our default with cloudkitty's (influxdb), and
also provides an upgrade transition to create the influxdb database.

We also move the cloudkitty_storage_backend variable to
group_vars/all.yml, since it is used to determine whether to enable
influxdb.

Finally, the section name in cloudkitty.conf was incorrect - it was
storage_influx,  but should be storage_influxdb.

Change-Id: I71f2ed11bd06f58e141d222e2709835b7ddb2c71
Closes-Bug: #1838641
2019-09-24 16:15:14 +00:00
Dincer Celik
5ff7bab46b [prometheus] Added support for extra options
This change introduces the way to pass extra options to prometheus.

Currently, prometheus runs with nearly default options, and when clouds
start getting bigger, you need to pass extra parameters to prometheus.

Change-Id: Ic773c0b73062cf3b2285343bafb25d5923911834
2019-09-23 11:25:04 +03:00
Zuul
b7bbbae981 Merge "Adding Prometheus blackbox exporter" 2019-09-20 17:25:04 +00:00
Zuul
91c68f5da8 Merge "Update "openstack_release" variable to static brach name" 2019-09-19 21:21:57 +00:00
Mark Goddard
15e35333dd Remove support for OracleLinux
We have agreed to remove support for Oracle Linux.

http://lists.openstack.org/pipermail/openstack-discuss/2019-June/006896.html

Change-Id: If11b4ff37af936a0cfd34443e8babb952307882b
2019-09-18 12:25:12 +01:00
Scott Solkhon
b22375ebfd Adding Prometheus blackbox exporter
This commit follows up the work in Kolla to provide deploy and configure the
Prometheus blackbox exporter.

An example blackbox-exporter module has been added (disabled by default)
called os_endpoint. This allows for the probing of endpoints over HTTP
and HTTPS. This can be used to monitor that OpenStack endpoints return a status
code of either 200 or 300, and the word 'versions' in the payload.

This change introduces a new variable `prometheus_blackbox_exporter_endpoints`.
Currently no defaults are specified because the configuration is heavily
dependent on the deployment.

Co-authored-by: Jack Heskett <Jack.Heskett@gresearch.co.uk>
Change-Id: I36ad4961078d90e2fd70c9a3368f5157d6fd89cd
2019-09-18 11:06:19 +01:00