21 Commits

Author SHA1 Message Date
Radosław Piliszek
bc053c09c1 Implement IPv6 support in the control plane
Introduce kolla_address filter.
Introduce put_address_in_context filter.

Add AF config to vars.

Address contexts:
- raw (default): <ADDR>
- memcache: inet6:[<ADDR>]
- url: [<ADDR>]

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic multinode source CI job for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Remove neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working (also IPv4-only)

haproxy upgrade checks for slaves based on ipv6 addresses

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address
No idea whether ovs-dpdk works at all atm.

ml2 for xenapi
Xen is not supported too well.
This would require working with XenAPI facts.

rp_filter setting
This would require meddling with ip6tables (there is no sysctl param).
By default nothing is dropped.
Unlikely we really need it.

ironic dnsmasq is configured IPv4-only
dnsmasq needs DHCPv6 options and testing in vivo.

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: https://github.com/moby/moby/issues/39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname/FQDN

RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4.
This is due to old RabbitMQ versions available in images.
IPv4 is preferred by default and may fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.
Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will
no longer be relevant as we supply all the necessary config.
See: https://github.com/rabbitmq/rabbitmq-server/pull/1982

For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed
to work well). Older Ansible versions are known to miss IPv6 addresses
in interface facts. This may affect redeploys, reconfigures and
upgrades which run after VIP address is assigned.
See: https://github.com/ansible/ansible/issues/63227

Bifrost Train does not support IPv6 deployments.
See: https://storyboard.openstack.org/#!/story/2006689

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
2019-10-16 10:24:35 +02:00
Joseph M
51033d9b31 [octavia] Add region-specific catalog lookups
octavia.conf is missing configuration values required to do service
catalog lookups in multiple region environments. Without them Octavia
can try to contact a service in a different region than its own. Specify
region_name and endpoint_type for the glance, neutron, and nova services
to prevent this from happening.

Change-Id: I753cf443c1506bbd7b69fc47e2e0a9b39857509c
Closes-Bug: #1841479
2019-08-26 18:11:36 -04:00
Jim Rollenhagen
55702739d0 Allow octavia services to use independent hostnames
This allows octavia service endpoints to use custom hostnames, and adds the
following variables:

* octavia_internal_fqdn
* octavia_external_fqdn

These default to the old values of kolla_internal_fqdn or
kolla_external_fqdn.

This also adds a octavia_api_listen_port option, which defaults to
octavia_api_port for backward compatibility.

This option allow the user to differentiate between the port the
service listens on, and the port the service is reachable on. This is
useful for external load balancers which live on the same host as the
service itself.

Change-Id: I1310eb5573a469b1a0e9549e853734455307a8b3
Implements: blueprint service-hostnames
2019-03-06 15:08:28 -05:00
Jim Rollenhagen
2e4e60503a Use keystone_*_url var in all configs
We're duplicating code to build the keystone URLs in nearly every
config, where we've already done it in group_vars. Replace the
redundancy with a variable that does the same thing.

Change-Id: I207d77870e2535c1cdcbc5eaf704f0448ac85a7a
2019-03-06 15:08:26 -05:00
Duc Nguyen Cong
144d9bbc2d Support list of controller ip for the amphorae heartbeat receiver
In multi controller deployment, kolla will generate
"controller_ip_port_list option" in [health_manager] section with
ONLY IP of that node instead of a list of controller ip.
Therefor, "amphora-agent.conf" file of amphora instance will
contain IP of ONLY ONE controller node.
In case of that node fail, amphora agent won't send heartbeat
message to other health manager node, and the loadbalancer will
go to ERROR state.

Change-Id: I102ed6ba3fff2c12cc6d37f81ad59508eacc859c
Co-Authored-By: Hieu LE <hieulq2@viettel.com.vn>
2018-12-19 16:30:09 +00:00
Dai Dang Van
22bf7997b9 Support Octavia custom policy
Change-Id: I542b06be75991412f8e2a931ea2e40f0a0c317e4
Closes-Bug: #1758903
2018-10-04 02:34:46 +00:00
Dai Dang Van
008d45b8de Add support Octavia network interface
For now, we use api interface/network for Octavia.

This change will make more flexible for Octavia deployment
with Kolla when we want to use another network for managing
amphora instances (config, health check, clean up)

Change-Id: Ief12f1f8b6c7d3974932e6320af95bb58d46bdb9
Co-Authored-By: Duc Nguyen Cong <ducnc7@viettel.com.vn>
Closes-Bug: #1791207
2018-09-19 01:04:29 +00:00
ZhongShengping
ae246945a6 Deprecate auth_uri option
Option auth_uri from group keystone_authtoken is deprecated[1].
Use option www_authenticate_uri from group keystone_authtoken.

[1]https://review.openstack.org/#/c/508522/

Co-Authored-By: confi-surya <singh.surya64mnnit@gmail.com>
Change-Id: Ifd8527d404f1df807ae8196eac2b3849911ddc26
Closes-Bug: #1761907
2018-08-07 11:58:23 +05:30
Andrew Smith
fd1d3af0df Add support for hybrid messaging backends
This commit separates the messaging rpc and notify transports in order
to support separate and different oslo.messaging backends

This patch:
* add rpc and notify variables
* update service role conf templates
* add example to globals.yaml
* add release note

Implements: blueprint hybrid-messaging
Change-Id: I34691c2895c8563f1f322f0850ecff98d11b5185
2017-11-22 14:09:40 -05:00
Zuul
dc19ee6605 Merge "fix wrong keystone_authtoken settings" 2017-10-02 16:13:01 +00:00
Zuul
bdf704843a Merge "bind_host and bind_port are coming under `api_setting" 2017-09-29 03:57:26 +00:00
yong sheng gong
fcbb75ceae fix wrong keystone_authtoken settings
Change-Id: Idfc0b4c6f4f5c699cd999662a98862ccc5286a5f
Closes-bug: 1720179
2017-09-28 16:28:16 +00:00
Jenkins
39a2b59056 Merge "Copy certifications info octavia housekeeping and health manager container" 2017-09-27 03:47:54 +00:00
Jeffrey Zhang
ef85df2335 Copy certifications info octavia housekeeping and health manager container
octavia-housekeeping container need certifications to create spare
amphore instances.

octavia-health-manager container need certifications to create stable
amphore instances.

Change-Id: I90b9c4c39f6542bb1ee5f40a8d0a39ae8d0ab2b0
Closes-Bug: #1719063
2017-09-26 15:42:57 +08:00
Jeffrey Zhang
b7bfe84a51 Use octavia account instead of admin in octavia
Closes-Bug: #1719503
Change-Id: I705de11614f2d086bd123ea5b3841f59b5a24666
2017-09-26 11:29:21 +08:00
ZhongShengping
b745d0a6dd bind_host and bind_port are coming under `api_setting
Option 'bind_host' from group 'DEFAULT' is deprecated for removal[0],
please use option 'bind_host' from group 'api_settings' instead. bind_port
option are the same.
The default value of api_handler is queue_producer, we did not configure
it. So delete api_handler option.

[0]https://github.com/openstack/octavia/blob/master/octavia/common/config.py#L45

Change-Id: I4e9c1d40bcb497f147ea38d4f3c6d78c181fa20b
Closes-Bug: #1717190
2017-09-22 09:45:46 +08:00
Bertrand Lallau
372e991bec Standardize Keystone domain variables
As described here:
https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L841
https://github.com/openstack/keystone/blob/master/keystone/conf/identity.py#L21

* default project domain name MUST be named 'Default'
* default project domain id MUST be named 'default'
* default project user name MUST be named 'Default'
* default project user id MUST be named 'default'

Change-Id: I610a0416647fdea31bb04889364da5395d8c8d74
2017-07-06 14:34:11 +00:00
Jenkins
3a68aee3ad Merge "Use auth vars for admin user" 2017-06-04 15:05:29 +00:00
Bertrand Lallau
afdd11b9a2 Generalize api_interface_address variable usage
Useful api_interface_address variable has been define here:
https://github.com/openstack/kolla-ansible/blob/master/ansible/group_vars/all.yml#L57
In order to simplify codebase we must use it as much as possible.

Change-Id: I18fec19bf69e05a22a4142a9cd1165eccd022455
2017-05-23 08:35:15 +00:00
Eduardo Gonzalez
e9bde0dcb9 Use auth vars for admin user
In someplace in the code admin user, project and domain name
are hardcoded.

This change use the correct variable defined at:
https://github.com/openstack/kolla-ansible/blob/master/ansible/group_vars/all.yml#L278

Change-Id: I3a4c78d81733bf7a2f3c67d259ec5c5f5bb38d3f
2017-05-16 08:54:37 +00:00
Jeffrey Zhang
7f89522b94 Implement octavia ansible role
Change-Id: Ic72b49275627aff239b23e9862966923555a464f
Implements: blueprint octavia-ansible-role
2016-12-12 16:27:34 +08:00