11218 Commits

Author SHA1 Message Date
Zuul
bc22925906 Merge "Add support for encrypting Horizon and Placement API" 2020-05-01 09:05:56 +00:00
Zuul
76b6cf9f6d Merge "Add support for encrypting Glance api" 2020-04-30 21:16:13 +00:00
James Kirsch
e3d5a91a90 Add support for encrypting Horizon and Placement API
This patch introduces an optional backend encryption for Horizon and
Placement services. When used in conjunction with enabling TLS for
service API endpoints, network communcation will be encrypted end to
end, from client through HAProxy to the Horizon and Placement services.

Change-Id: I9cb274141c95aea20e733baa623da071b30acf2d
Partially-Implements: blueprint add-ssl-internal-network
2020-04-30 20:55:07 +01:00
James Kirsch
f87814f794 Add support for encrypting Glance api
Add TLS support for Glance api using HAProxy to perform TLS termination.

Change-Id: I77051baaeb5d3f7dd9002262534e7d35f3926809
Partially-Implements: blueprint add-ssl-internal-network
2020-04-30 17:31:58 +01:00
Hongbin Lu
91678f67af Zun: Add zun-cni-daemon to compute node
Zun has a new component "zun-cni-daemon" which should be
deployed in every compute nodes. It is basically an implementation
of CNI (Container Network Interface) that performs the neutron
port binding.

If users is using the capsule (pod) API, the recommended deployment
option is using "cri" as capsule driver. This is basically to use
a CRI runtime (i.e. CRI plugin for containerd) for supporting
capsules (pods). A CRI runtime needs a CNI plugin which is what
the "zun-cni-daemon" provides.

The configuration is based on the Zun installation guide [1].
It consits of the following steps:
* Configure the containerd daemon in the host. The "zun-compute"
  container will use grpc to communicate with this service.
* Install the "zun-cni" binary at host. The containerd process
  will invoke this binary to call the CNI plugin.
* Run a "zun-cni-daemon" container. The "zun-cni" binary will
  communicate with this container via HTTP.

Relevant patches:
Blueprint: https://blueprints.launchpad.net/zun/+spec/add-support-cri-runtime
Install guide: https://review.opendev.org/#/c/707948/
Devstack plugin: https://review.opendev.org/#/c/705338/
Kolla image: https://review.opendev.org/#/c/708273/

[1] https://docs.openstack.org/zun/latest/install/index.html

Depends-On: https://review.opendev.org/#/c/721044/
Change-Id: I9c361a99b355af27907cf80f5c88d97191193495
2020-04-30 02:22:20 +00:00
Zuul
70e7b1b0d8 Merge "Add feature to support managing dynamic pollsters" 2020-04-29 17:45:34 +00:00
Zuul
059fee1ea3 Merge "Add support for encrypting heat api" 2020-04-29 17:19:51 +00:00
Zuul
12a0ffa305 Merge "Fix telegraf invalid TOML syntax" 2020-04-29 12:00:56 +00:00
Zuul
8d4157a510 Merge "Adapt to Octavia Certificate Configuration Guide." 2020-04-29 11:46:54 +00:00
Noboru Iwamatsu
e84c968ed2 Adapt to Octavia Certificate Configuration Guide.
This patch updates the octavia controller deployment to use the
latest octavia certificate configuration guide [1]. The dual CA changes
were introduced in Train.

[1] https://docs.openstack.org/octavia/latest/admin/guides/certificates.html

Change-Id: If89ec0d631568db70690f1a69d00115c59abe678
Closes-Bug: #1862133
2020-04-29 08:30:12 +03:00
xiaojueguan
7ad7c88046 Fix telegraf invalid TOML syntax
Change-Id: Ie3022d1721f43dc84e4228331d0d2f6f3a3c7ebd
Closes-Bug: 1875613
2020-04-29 11:14:31 +08:00
Zuul
10036c0736 Merge "CI: Fix Debian aarch64 jobs" 2020-04-29 01:25:58 +00:00
Zuul
2f77670f7d Merge "ironic: handle Swift object storage" 2020-04-29 00:53:48 +00:00
Marcin Juszkiewicz
30b8eed1cd CI: Fix Debian aarch64 jobs
Debian defaults to Python2 which is not complete in aarch64 images.
This patch changes CI to always use Python3.

We need to install several Python modules to have working ussuri jobs.

"Failed to import the required Python library (setuptools) on primary's Python /usr/bin/python3."

And then several Python2 ones for train->ussuri upgrade jobs:

"Unable to find any of pip2 to use. pip needs to be installed."

Change-Id: Ia0d3ff15d97d1cabbb0b8e7f32e8712ca3f94732
2020-04-28 19:15:06 +02:00
Marcin Juszkiewicz
fee9ff9c9d ironic: handle Swift object storage
Change-Id: I18f8855a758703968aba032add68add24b31f673
Closes-bug: #1875588
2020-04-28 13:00:16 +02:00
Xing Zhang
01ae01ec26
Make sure octavia uses internal endpoint to barbican
The octavia service communicates to the barbican service with
public endpoint_type by default[1], it should use internal
like other services.

[1] 0056b5175f/octavia/common/config.py (L533-L537)

Closes-Bug: #1875618
Change-Id: I90d2b0aeac090a3e2366341e260232fc1f0d6492
2020-04-28 18:55:32 +08:00
Zuul
0747ebf1c9 Merge "Add docs and release note for CentOS 8" 2020-04-27 15:58:13 +00:00
Zuul
1939c3ce68 Merge "[octavia] Adds region_name if enable_barbican" 2020-04-27 13:51:12 +00:00
Zuul
c151449e09 Merge "Fix haproxy restarting twice per Ansible run" 2020-04-27 13:48:00 +00:00
Zuul
23eb41de7e Merge "Remove redundant listen on haproxy handler" 2020-04-27 13:31:47 +00:00
Zuul
3d550cd38c Merge "Cleanup py27 support" 2020-04-27 13:31:45 +00:00
ramboman
6c372312ad [octavia] Adds region_name if enable_barbican
Adds necessary "region_name" to octavia.conf when
"enable_barbican" is set to "true".

Closes-Bug: #1867926

Change-Id: Ida61cef4b9c9622a5e925bac4583fba281469a39
2020-04-27 09:53:57 +03:00
Radosław Piliszek
04effaa903 Fix haproxy restarting twice per Ansible run
Since haproxy is orchestrated via site.yml in a single play,
it does not need flushing handlers as handlers run will
happen at the end of this play.

Change-Id: Ia3743575da707325be93c39b4a2bcae9211cacb2
Related-Bug: #1864810
Closes-Bug: #1875228
2020-04-26 21:51:20 +02:00
Radosław Piliszek
98e86ea62b Remove redundant listen on haproxy handler
Follow-up on [1] "Avoid multiple haproxy restarts after
reconfiguration".

There is no need to duplicate handler name in listen.
The issue was because we had two handlers with the same
name in the same environment.
This causes Ansible not to mark handler as already run.

[1] https://review.opendev.org/708385

Change-Id: I5425a8037b6860ef71bce59becff8dfe5b601d4c
Related-Bug: #1864810
2020-04-26 21:23:25 +02:00
Zuul
d5b7b71834 Merge "CI: add Debian source upgrade job on AArch64" 2020-04-26 19:15:11 +00:00
Zuul
76d69cae0e Merge "Fix nova cell message queue URL with separate notification queue" 2020-04-26 16:46:35 +00:00
Zuul
4d49397d72 Merge "nova: Add debug logging to libvirtd.conf" 2020-04-26 15:46:29 +00:00
Zuul
755a73626d Merge "Avoid multiple haproxy restarts after reconfiguration" 2020-04-26 15:41:31 +00:00
Radosław Piliszek
234272eb64 Cleanup py27 support
Removes and/or replaces all mentions of py27.

Cleans up obsolete requirements and their lower-constraints.

Separates test-requirements.

Makes lower-constraints pass outside of CI (MarkupSafe).

Adds FIXMEs about some hacky Mocks that may misbehave.

Change-Id: Ifc090bf3c1db17d8542ee591c91e8225a597bfe2
2020-04-26 12:16:44 +02:00
Zuul
b1db4f5c3b Merge "[skydive] fix: Use Keystone backend to authenticate API users" 2020-04-25 11:37:10 +00:00
Nick Jones
7e5aa63728 [skydive] fix: Use Keystone backend to authenticate API users
Update Skydive Analyzer's configuration to use Keystone as its backend
for authenticating users.  Any user with a role in the project defined
by the variable skydive_admin_tenant_name will be able to access
Skydive.

Change-Id: I64c811d5eb72c7406fd52b649fa00edaf2d0c07b
Closes-Bug: 1870903
2020-04-24 19:31:57 +00:00
Mark Goddard
8cf8ab4e54 Add docs and release note for CentOS 8
Adds a support matrix page to documentation.

Change-Id: Ia783f7c42219617cde2accd3f1db013c9bda7679
2020-04-24 14:52:18 +00:00
Radosław Piliszek
3036c7cfda CI: Make bashate happy
Bashate warned on init-swift.sh because of E043 -- arithmetic
compound has inconsistent return semantics: (( next_port++ ))
New Zuul reported that on every change as a warning.
This is fixed here.

This change makes Bashate always produce errors so that we do not
introduce such warnings again.

Change-Id: I40166b377ec2580e17901375b636183bca492d3a
2020-04-24 15:57:55 +02:00
James Kirsch
ff84292269 Add support for encrypting heat api
This patch introduces an optional backend encryption for Heat
service. When used in conjunction with enabling TLS for service API
endpoints, network communcation will be encrypted end to end, from
client through HAProxy to the Heat service.

Change-Id: Ic12f7574135dcaed2a462e902c775a55176ff03b
Partially-Implements: blueprint add-ssl-internal-network
Depends-On: https://review.opendev.org/722028/
2020-04-24 12:23:48 +01:00
Zuul
9251315b36 Merge "CI: Test ironic on nova-cell change" 2020-04-24 10:26:28 +00:00
Raimund Hook
8618cfac2f Removing a extra word in Central Logging docs
Just making it slightly more readable - there was an extra 'an'.

TrivialFix

Change-Id: I488f702449e217335321988874b6c3ee3136f497
Signed-off-by: Raimund Hook <openstack@sting-ray.za.net>
2020-04-23 12:57:44 +01:00
Zuul
3f4103faed Merge "Fix that cyborg agent failed to start privsep daemon." 2020-04-22 15:44:33 +00:00
ya.wang
953edb870e Fix that cyborg agent failed to start privsep daemon.
Add privileged capability to cyborg agent.

Change-Id: Id237df1acb1b44c4e6442b39838058be1a95fcc6
Closes-bug: #1873715
2020-04-22 07:35:39 +00:00
Marcin Juszkiewicz
1da111e1cb Drop handling of 'easy_install'
Looks like none of supported distros has it so why bother?

Change-Id: I3411c00664eac4e5ba9b79bff39f3d8b7514ad24
2020-04-22 09:28:17 +02:00
Zuul
ca9e6f1a4e Merge "Improve CI ansible plays to pass ansible-lint" 2020-04-21 21:15:20 +00:00
Zuul
5079fa240d Merge "Manage nova scheduler workers count" 2020-04-21 19:36:44 +00:00
Zuul
6a49e4d30b Merge "Fix that cyborg conductor failed to communicate with placement" 2020-04-21 18:57:14 +00:00
Marcin Juszkiewicz
f40886f6d2 Improve CI ansible plays to pass ansible-lint
Change-Id: I150c8952aad7b6fdb1260b343c26a96fb2360bce
2020-04-21 18:05:42 +00:00
Zuul
5273828fae Merge "Remove support for Python 2 on the host" 2020-04-21 17:01:25 +00:00
Christian Berendt
1efe0fe333 Avoid multiple haproxy restarts after reconfiguration
The haproxy role and the site.yml file calls the
haproxy-config role to provide configuration for individual
services.

If the configuration within a service changes, the haproxy
container is restarted.

If the configuration in n services changes, there will be n
restarts. This is not necessary, a restart at the end is
sufficient.

By removing the handler from the haproxy-config role and
using the listen parameter in the handler of the haproxy role,
the handler is executed only once.

Change-Id: I535fe67579fb748093bb4b30a6bd31b81e021a1b
Closes-Bug: #1864810
2020-04-21 11:25:53 +00:00
Jeffrey Zhang
8523ab569d Manage nova scheduler workers count
Closes-Bug: 1873753
Change-Id: Ibf75b3fd3090d47b50c71d17f6c12177d16442ab
2020-04-21 09:15:36 +00:00
Zuul
7a34f82a60 Merge "Fix monasca deployment due to monasca_log_dir" 2020-04-21 07:05:34 +00:00
Zuul
9f54c6fd1b Merge "Remove support for CentOS 7" 2020-04-20 16:57:53 +00:00
Zuul
95471c47cc Merge "Fix kibana deployment with openstack_cacert unset" 2020-04-20 16:19:04 +00:00
Mark Goddard
284f492861 Remove support for Python 2 on the host
Drops support for creating Python 2 virtualenvs in bootstrap-servers,
and looking for a python2 interpreter in the kolla-ansible script.

Also forces the use of Python 3 as the remote interpreter in CI on
Debian and Ubuntu hosts, since they typically symlink the unversioned
interpreter to python2.7.

Change-Id: Id0e977de381e7faafed738674a140ba36184727e
Partially-Implements: blueprint drop-py2-support
2020-04-20 16:18:31 +00:00