13859 Commits

Author SHA1 Message Date
Michal Nasiadka
b04486df07 Bump ansible-core versions to 2.15 and 2.16
Change-Id: Iab40eb92c7e4a9092471bef9d4477a4fa34f1c85
2024-03-14 06:13:38 +00:00
Michal Nasiadka
7bb50ee05e rabbitmq: bump wait timeout to 60 seconds
Closes-Bug: #2057676

Change-Id: I9e0287a4e80b1ebcecf9e3b66c11d4233970a30b
2024-03-12 14:48:41 +00:00
Michal Arbet
8c760d38a0 Fix creation of ovs bridges
This patch fixes the creation of the openvswitch
bridge by fixing an ansible task that was rewritten
to use an ansible module, but unfortunately, its loop
was implemented incorrectly.

Closes-Bug: #2056332
Change-Id: Ia55a36c0f9b122b72d757ca973e7d8f76ae84344
2024-03-11 09:49:51 +01:00
Michal Arbet
59da07920b Fix coordination when redis used
Tooz 6.0.1 includes commit [1], which introduced
parsing the username from the Redis connection URL.
As a result, services started authenticating as admin
which, by the way, was incorrect even before, as either
a created user or the default one should have been used.

The reason it worked before is simply because the username
'admin' wasn't parsed anywhere.

This patch fixes the user being used and sets the correct
'default' one.

[1] https://review.opendev.org/c/openstack/tooz/+/907656

Closes-Bug: #2056667
Depends-On: https://review.opendev.org/c/openstack/kolla/+/911703
Change-Id: I5568dba15fa98e009ad4a9e41756aba0fa659371
2024-03-11 09:49:01 +01:00
Zuul
5169e3bcbe Merge "Fix typo in release note" 2024-03-07 13:52:12 +00:00
Zuul
3760eac763 Merge "CI: Replace etcd with redis in GATE_IMAGES for cephadm scenario" 2024-03-06 12:28:02 +00:00
Zuul
a7dd2425ec Merge "prometheus: Add friendly instance labels for ironic and alertmanager" 2024-03-06 12:27:58 +00:00
Michal Nasiadka
a88ebd77b0 CI: Replace etcd with redis in GATE_IMAGES for cephadm scenario
We replaced redis with etcd in that scenario, but GATE_IMAGES
are not updated.

Change-Id: Ie9d6642f8ce51bc2a35b800c6c149153c14378db
2024-03-05 16:49:45 +01:00
Pierre Riteau
6ac502ec20 Fix typo in release note
Change-Id: I2f6cd19b7f4d3954bf9de17e6095d39545fe05d3
2024-03-01 09:30:12 +01:00
Michal Nasiadka
add8351834 Missing reno for Ic121bf9f90c9865cd4d08890c80247570ef310ae
Folowup for missing release note, see [1].

[1]: https://review.opendev.org/q/Ic121bf9f90c9865cd4d08890c80247570ef310ae

Change-Id: Ia65e4e28d8a8dfdf439adbdd5a2516b6c064109a
2024-03-01 09:11:59 +01:00
Zuul
06e39af796 Merge "Adds feature flag for ironic-inspector in bifrost" 2024-02-29 17:05:13 +00:00
Zuul
d42cdef420 Merge "Add password rotation docs page" 2024-02-29 11:37:52 +00:00
Will Szumski
4d40c9e68f Adds feature flag for ironic-inspector in bifrost
This is useful for backwards compatability.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/909865
Change-Id: Ib2936580db5e7ab3479722bc353c39063010b5f2
2024-02-28 14:59:29 +00:00
Mark Goddard
10f0e9ddef prometheus: Add friendly instance labels for ironic and alertmanager
These were omitted from I387c9d8f5c01baf6054381834ecf4e554d0fff35 and
I387c9d8f5c01baf6054381834ecf4e554d0fff35.

Closes-Bug: #2041855
Change-Id: I25e5450d1caeebd9c900c190fc0079988f1ca574
2024-02-28 12:16:32 +00:00
Zuul
e513ddd982 Merge "Adjust Ceph metrics scrape interval in Prometheus" 2024-02-27 11:59:32 +00:00
Zuul
ce3a6aff09 Merge "Fix gnocchi-metricd when TLS and Swift enabled" 2024-02-21 16:02:52 +00:00
Alex-Welsh
d6d82e2a88 Add password rotation docs page
Closes-Bug: #1793323
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/903178
Depends-On: https://review.opendev.org/c/openstack/kolla/+/902057
Change-Id: Ibebd6e04de215e1a1aaff52c55d28c4741af98f2
2024-02-21 12:02:34 +00:00
Zuul
d30fb56c2a Merge "Remove the grafana volume" 2024-02-20 17:25:50 +00:00
Zuul
ff63af4e65 Merge "cinder: Stop using admin service token" 2024-02-20 14:24:34 +00:00
Zuul
3c77151225 Merge "Revert "Disable new defaults and scope for Ironic (RBAC)"" 2024-02-19 12:43:31 +00:00
Zuul
311fd881e4 Merge "Template system scoped admin-openrc and clouds.yml files" 2024-02-19 12:40:06 +00:00
Zuul
33129b7554 Merge "Add service role to ironic service users" 2024-02-19 12:40:03 +00:00
Zuul
a6fa564499 Merge "Ironic: enable elevated access for project scoped service role" 2024-02-19 12:40:00 +00:00
Zuul
a3f3dc7ab5 Merge "CI: Change prometheus jobs to voting and gating" 2024-02-15 19:23:39 +00:00
Bartosz Bezak
c51fbfdd8b Revert "Disable new defaults and scope for Ironic (RBAC)"
This reverts commit d77372e86ab078711d48dbe2917714f338842ca5.

Reason for revert: service role support has been fixed in Ironic [1]
and added to Kolla-Ansible.

[1] https://review.opendev.org/c/openstack/ironic/+/907148

Closes-Bug: #2051837

Change-Id: I49664e3a353f54e0d51f454c552a78846ba64101
2024-02-15 15:14:56 +00:00
Bartosz Bezak
6e835ae758 Template system scoped admin-openrc and clouds.yml files
Ironic enabled secure RBAC with system scoped enforcement [1].

Some API calls, for instance 'baremetal:driver:get' needs system
scope role by design [2], even with elevated access project scope
service role [3].

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] 8ec5606622/ironic/common/policy.py (L1349-L1357)
[3] https://review.opendev.org/c/openstack/kolla-ansible/+/908007

Related-Bug: #2051837

Change-Id: Id6313d7dd343b82d4c9ccf7bf429d340ea0e93d1
2024-02-15 15:01:59 +00:00
Zuul
0701436fd2 Merge "CI: Fix prometheus-opensearch-upgrade CI job" 2024-02-15 14:57:34 +00:00
Zuul
0dac9eb93d Merge "Fix mariadb role when used with check mode" 2024-02-15 14:13:18 +00:00
Bartosz Bezak
600e912400 Add service role to ironic service users
Add the service role to ironic service users. Ironic recently enforced
new policy validation as part of the RBAC efforts. [1][2]
Service user support was also added to Ironic. [3]
Admin role needs to stay as not all services added service role support. [4][5]

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] e2a47de10a/goals/selected/consistent-and-secure-rbac.rst (phase-2)
[3] https://review.opendev.org/c/openstack/ironic/+/907148
[4] https://review.opendev.org/q/topic:bp%252Fpolicy-service-role-default
[5] https://review.opendev.org/q/topic:%22New-Location-Apis%22

Related-Bug: #2051837
Change-Id: I048402c2247188cf57f35437f557f84ac25d4ff2
2024-02-15 14:05:52 +00:00
Bartosz Bezak
121aa3d258 Ironic: enable elevated access for project scoped service role
Ironic recently started to enforce new policies and scope [1].
And Ironic is one of the sole openstack project which need
system scope for some admin related api calls [2].
However Ironic also started to allow project-scope behaviour
for service role with setting
``rbac_service_role_elevated_access``[3] [4]. This change enables
this setting to get similar behaviour of service role as other
openstack projects.

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] e2a47de10a/goals/selected/consistent-and-secure-rbac.rst (L261)
[3] https://review.opendev.org/c/openstack/ironic/+/907148
[4] 8ec5606622/releasenotes/notes/service-project-service-role-fix-e4d1a8c23856926a.yaml

Related-Bug: #2051837

Change-Id: If8d7cf1663145d0398a2e936486e2b316d4df5e0
2024-02-15 15:04:06 +01:00
Michal Nasiadka
1ef765f690 cinder: Stop using admin service token
In order to do this - we need to add service role to Nova and Cinder.

Closes-Bug: #2049762

Change-Id: Ic121bf9f90c9865cd4d08890c80247570ef310ae
2024-02-15 12:07:39 +00:00
Michal Nasiadka
7d897399f0 CI: Change prometheus jobs to voting and gating
Change-Id: I5bc50e390d0b8100a1b6bf5bd5c8b6ecdeb7cd6c
2024-02-15 10:59:38 +00:00
Doug Szumski
afa202e259 CI: Fix prometheus-opensearch-upgrade CI job
The upgrade job needs the haproxy exporter group, which
was missing from the inventory.

Change-Id: Ie4ecf283a2f4ac056ace5e76f2acc4ba1a8fe0b4
2024-02-15 10:59:34 +00:00
Michal Nasiadka
63cf525af5 CI: Increase RADOS timeout for cephadm jobs
Default timeout is 5 and we're often hitting that on our poor man's
Ceph.

Change-Id: Ide92b3c32150c0045b0723155f94b21ea9cdce66
2024-02-14 10:02:35 +00:00
Michal Nasiadka
fe155496e1 CI: Switch cephadm jobs to redis
etcd is flakey and complaining over slow disk

Change-Id: I1f5191015b53bdb218cfeaa43586ecf2d71a161e
2024-02-13 12:46:23 +01:00
Dawud
8962b4081e
Remove the grafana volume
Fixes not being able to add additional plugins at build time due to the
`grafana` volume being mounted over the existing `/var/lib/grafana`
directory. This is fixed by copying the dashboards into the container
from an existing bind mount instead of using the ``grafana`` volume.
This however leaves behind the volume which should be removed with
`docker volume rm grafana` or by setting `grafana_remove_old_volume` to
`True`.

Closes-Bug: #2039498
Change-Id: Ibcffa5d8922c470f655f447558d4a9c73b1ba361
2024-02-12 16:03:19 +00:00
Zuul
07bbf1707f Merge "[CI] Enable testing horizon" 2024-02-09 13:03:12 +00:00
Zuul
92286fa7ee Merge "Fix horizon deployment" 2024-02-09 12:57:33 +00:00
Zuul
23909f1b9e Merge "CI: Run SLURP upgrade job" 2024-02-09 10:41:54 +00:00
Zuul
35352a6be0 Merge "Rework horizon role to support local_settings.d" 2024-02-08 20:45:20 +00:00
Zuul
8ccdc1898e Merge "Rename horizon settings filenames" 2024-02-08 16:09:17 +00:00
Michal Nasiadka
09fb029569 CI: Run SLURP upgrade job
Change-Id: I246b14c9b547c6a0ff0be68ad57e723839cc3275
2024-02-08 13:13:35 +00:00
Zuul
54451a814b Merge "openvswitch: Set fail_mode to standalone for external bridges" 2024-02-08 11:38:15 +00:00
Michal Arbet
05462c471c [CI] Enable testing horizon
Change Ib7f72b2663199ef80844a412bc436c6ef09322cc
disabled horizon testing. This patch enabling
horizon tests again.

Change-Id: Iff670525c91c8adbcf2a01288b12456cb4a31809
2024-02-07 16:13:27 +01:00
Michal Arbet
4108aea879 Fix horizon deployment
New horizon release use [1] for cache backend
instead of [2] as it was in previous versions.

This patch:

1. Removes override from config and
   configure only memcached endpoints, not backend
   specification itself. This will avoid bugs
   in future in case BACKEND will be switched again.

2. Remove 'memcached' context from kolla_address filter
   and use 'url' as [1] don't support inet6:[{address}]
   for ipv6 but supports [{address}] which 'url' provides.

[1] django.core.cache.backends.memcached.PyMemcacheCache
[2] django.core.cache.backends.memcached.MemcachedCache

Change-Id: Ie3a8f47e7b776b6aa2bb9b1522fdd4514ea1484b
2024-02-07 16:13:27 +01:00
Michal Arbet
b5aa63dee1 Rework horizon role to support local_settings.d
This patch implements horizon's preferred way how
to configure itself described in docs [1],

[1] https://docs.openstack.org/horizon/latest/configuration/settings.html

Depends-On: https://review.opendev.org/c/openstack/kolla/+/906339
Change-Id: I60ab4634bf4333c47d00b12fc4ec00570062bd18
2024-02-07 16:13:26 +01:00
Michal Nasiadka
5016b3efaf openvswitch: Set fail_mode to standalone for external bridges
That is the ovs-vsctl default but Ansible module is failing in
reconfigure step - and secure breaks external connectivity in
OVN.

From OVS docs:
fail_mode: optional string, either secure or standalone

When  a controller is configured, it is, ordinarily, responsible
for setting up all flows on the switch. Thus, if the  connection
to  the  controller fails, no new network connections can be set
up. If the connection to the controller stays down long  enough,
no  packets can pass through the switch at all. This setting de‐
termines the switch’s response to such a situation.  It  may  be
set to one of the following:

standalone
    If  no  message is received from the controller for three
    times  the  inactivity  probe  interval   (see   inactiv‐
    ity_probe), then Open vSwitch will take over responsibil‐
    ity for setting up flows.  In  this  mode,  Open  vSwitch
    causes  the  bridge  to act like an ordinary MAC-learning
    switch. Open vSwitch will continue to retry connecting to
    the controller in the background and, when the connection
    succeeds, it will discontinue its standalone behavior.

secure 
    Open vSwitch will not set up flows on its  own  when  the
    controller  connection  fails  or when no controllers are
    defined. The bridge will continue to retry connecting  to
    any defined controllers forever.

The default is standalone if the value is unset, but future ver‐
sions of Open vSwitch may change the default.

Change-Id: Ica4dda2914113e8f8349e7227161cb81a02b33ee
2024-02-07 13:34:50 +00:00
Zuul
074d8b0ebf Merge "Enable HAProxy Prometheus metrics endpoint" 2024-02-07 10:33:24 +00:00
Zuul
53f2c582d9 Merge "Update keystone service user passwords" 2024-02-07 10:07:30 +00:00
Michal Arbet
d0b93a631d Fix mariadb role when used with check mode
This patch adds check_mode: false to tasks
in restart_services.yml which just checking
some WSREP status and if port is UP.

Closes-Bug: #2052501
Change-Id: I92a591900d85138a87991a18dd4339efd053ef1b
2024-02-06 10:39:34 +01:00