Add TLS support for Glance api using HAProxy to perform TLS termination.
Change-Id: I77051baaeb5d3f7dd9002262534e7d35f3926809
Partially-Implements: blueprint add-ssl-internal-network
Zun has a new component "zun-cni-daemon" which should be
deployed in every compute nodes. It is basically an implementation
of CNI (Container Network Interface) that performs the neutron
port binding.
If users is using the capsule (pod) API, the recommended deployment
option is using "cri" as capsule driver. This is basically to use
a CRI runtime (i.e. CRI plugin for containerd) for supporting
capsules (pods). A CRI runtime needs a CNI plugin which is what
the "zun-cni-daemon" provides.
The configuration is based on the Zun installation guide [1].
It consits of the following steps:
* Configure the containerd daemon in the host. The "zun-compute"
container will use grpc to communicate with this service.
* Install the "zun-cni" binary at host. The containerd process
will invoke this binary to call the CNI plugin.
* Run a "zun-cni-daemon" container. The "zun-cni" binary will
communicate with this container via HTTP.
Relevant patches:
Blueprint: https://blueprints.launchpad.net/zun/+spec/add-support-cri-runtime
Install guide: https://review.opendev.org/#/c/707948/
Devstack plugin: https://review.opendev.org/#/c/705338/
Kolla image: https://review.opendev.org/#/c/708273/
[1] https://docs.openstack.org/zun/latest/install/index.html
Depends-On: https://review.opendev.org/#/c/721044/
Change-Id: I9c361a99b355af27907cf80f5c88d97191193495
Removes and/or replaces all mentions of py27.
Cleans up obsolete requirements and their lower-constraints.
Separates test-requirements.
Makes lower-constraints pass outside of CI (MarkupSafe).
Adds FIXMEs about some hacky Mocks that may misbehave.
Change-Id: Ifc090bf3c1db17d8542ee591c91e8225a597bfe2
Just making it slightly more readable - there was an extra 'an'.
TrivialFix
Change-Id: I488f702449e217335321988874b6c3ee3136f497
Signed-off-by: Raimund Hook <openstack@sting-ray.za.net>
This update clears up an additional path that was mentioned in the
Advanced Configuration documentation, but not actually picked up in the
playbooks.
This specifically affects Service Configuration overrides. The docs have
been cleaned up to reflect the way the playbooks pick up the override
files.
Change-Id: Id15fe139af6462217c2ac26d7d21c5eac5368e12
Closes-Bug: 1873782
Signed-off-by: Raimund Hook <openstack@sting-ray.za.net>
etcd via tooz does not support group membership required by
Designate coordination.
The best k-a can do is not to configure etcd in Designate.
Change-Id: I2f64f928e730355142ac369d8868cf9f65ca357e
Closes-bug: #1872205
Related-bug: #1840070
This patch introduces an optional backend encryption for Keystone
service. When used in conjunction with enabling TLS for service API
endpoints, network communcation will be encrypted end to end, from
client through HAProxy to the Keystone service.
Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519
Partially-Implements: blueprint add-ssl-internal-network
Not everyone wants Kafka data stored on a Docker volume. This
change allows a user to flexibly control where the data is stored.
Change-Id: I2ba8c7a85c7bf2564f954a43c6e6dbb3257fe902
There is no longer support for provisioning Ceph in Kolla Ansible, so we
should no longer say that it's only sometimes necessary to create the
cluster/pools/keyrings externally.
Change-Id: Ia3026cfeebfb8258b79490f9facc341c928845f9
This allows you to tune the performance of InfluxDB by locating the
volume on a drive that is separate to the default docker storage.
Change-Id: Iea555a2702b225b30f5d7035b8a703d4f3376ee7
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1].
This change removes the Ansible code and associated CI jobs.
[1]: https://review.opendev.org/669214
Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
Ports need physical-network to be set for a flat network, otherwise they
will not bind.
Closes-Bug: #1862628
Change-Id: I9d579b4317a8acbc3e51bbd9c0236846b75d598b
Backport: train
* Ironic dropped CoreOS IPA images in Train - use CentOS DIB images
* Nova flavor requires dropping standard resources
* Link to sections in ironic docs
Change-Id: Id65ada7cd6766d3a907a5a1da54978b56319979c
To make the configuration easier for the user, and to allow non-standard
ceph authentication ids - introduce ceph_*_user variables.
Change-Id: I24e01c43c826b62b6748d93a498f4b7d8ce9e309
Generate both internal and external self signed TLS certificates.
Duplicate the certificate if internal and external VIPs are the same.
Change-Id: I16b345c0b29ff13e042eed8798efe644e0ad2c74
Partially-Implements: blueprint custom-cacerts
When kolla_copy_ca_into_containers is set to "yes", the Certificate
Authority in /etc/kolla/certificates will be copied into service
containers to enable trust for that CA. This is especially useful when
the CA is self signed, and would not be trusted by default.
Partially-Implements: blueprint custom-cacerts
Change-Id: I4368f8994147580460ebe7533850cf63a419d0b4
This change introduces prune-images command.
Uses docker_prune module of Ansible that comes with version 2.8.
Depends-On: https://review.opendev.org/#/c/699333/
Implements: blueprint docker-image-pruning
Change-Id: Icbf374dd50e1cc1f1604bb4fa779b34279efd50c
Introduce user modifiable variables instead of fixed-names
of Ceph keyring files for external Ceph functionality.
Change-Id: I1a33b3f9d6eca5babf53b91187461e43aef865ce
Maximum supported version is set to 2.9
Updated the minimum supported version to 2.8
Implements: blueprint ansible-max-version
Change-Id: I97cc95e37f49886e6d74f2d5a789b923b14b5a2d
It advertises C7 as an IPv6-compatible platform.
This is possible thanks to fixes in [1] and [2].
[1] https://review.opendev.org/699458
aka 7054b27dbb8bc893c50f66b492b7e14e5bc92237
[2] https://review.opendev.org/699172
aka 908bffcfc2950e271fee1af24fb174fa6bee4aff
Change-Id: Ia353a1663a16f48ac83e5ee9a2cf1d6e183ac3a3
Closes-bug: #1848444
Closes-bug: #1848452
Related-bug: #1856532
Related-bug: #1856725
This is to fix the duplicated words issue like
"Other services that are are out of scope of this".
Change-Id: Ie4882dbb64d6e8774888b97895af20ba3855f0f8
