The Orchestration service automatically assigns the heat_stack_user
role to users that it creates during stack deployment.
To avoid conflicts, do not add this role to users with the heat_stack_owner role.
Closes-Bug: #1690975
Change-Id: I7a4cb7f4a13de7be4fc9ce9c24057ece6a0ced5c
wait_for module waits 300 seconds for the port started or stopped. This
is meaningless and useless in precheck. This patch change timeout to 1
seconds.
Change-Id: I9b251ec4ba17ce446655917e8ef5e152ef947298
Closes-Bug: #1688152
While in openstack deployment guides use Orchestration as
heat-cfn description, heat devstack plugin uses CloudFormation.
I think is more accurate and easier to know which service is.
Change-Id: I760c7e7baa46da57fd2fca9d5409f370a0c9065c
Closes-Bug: #1673421
Add a new subcommand 'check' to kolla-ansible, used to run the
smoke/sanity checks.
Add stub files to all services that don't currently have checks.
Change-Id: I9f661c5fc51fd5b9b266f23f6c524884613dee48
Partially-implements: blueprint sanity-check-container
heat-api kept redirecting clients to use http:// instead of https://
when communicating with our https:// only loadbalancer
Please examine the logic for enabling it carefully, it's hard to know
if it should be enabled or not, potenitially it could be a security
risk.
Based on openstack-ansible-os_heat:
commit 4033a0f854cba6719c61812ef5b553e932a6c6c2
Author: Kyle L. Henderson <kyleh@us.ibm.com>
Enable oslo_middleware proxy header parsing
"Heat has moved to using oslo_middleware for the http proxy header
parsing, however the default is to not parse the headers. When
the external protocol differs from the internal protocol this
parsing is required in order for heat to work properly since it
will return 302 redirects to the client during some operations
(such as delete stack).
An example of this is when using haproxy with https configured
for the external protocol and http for the internal protocol.
If the oslo_middleware does not parse the headers, then any
302 redirects would specify a url with http rather than
correctly specifying https and the heat client would fail to
connect on the redirect url."
Change-Id: I38661a0bc2163a7f72febd98b7ae6f51c5d45ad5
Usernames can be configured with variables in
configuration files, but user creation is hardcoded.
Change-Id: I057cfb921d776217db66f59226dcfa79f3eb7368
Closes-Bug: #1661587
A config generation check was added to a few services but the action
name checked was "genconfig" where the kolla-ansible genconfig command
actually uses the action name "config".
Stop run the handlers when action is "config".
Co-Authored-By: Jeffrey Zhang <jeffrey.zhang@99cloud.net>
Partially-implements: blueprint better-reconfigure
Change-Id: I9d3be2f674087f340108b176c8e8e2209ffa8806
Making variable name "works" to "workers" for correct configuration
as followed in other services
Closes-Bug: #1655081
Change-Id: I333b7a7a98770e640db49e8103900957c629bad5
Currently, policy.json is put in
"{{ node_config_directory }}/{{ service_name }}"
in target nodes.
Relocation policy.json to "{{ node_config_directory }}/{{ item }}"
with item is corresponding service compoment config directory.
Currently, the policy.json is copied to all services, but it
should be reviewed and left only in neccesary service
(at many cases, only API service needs that).
Redundant files will be removed in follow up patchset.
Change-Id: I0e997dccf4ec438c9c0436db71ec2fd06650f50d
Closes-Bug: #1639686
Allow operators to use their custom policy files.
Avoid maintain policy files in kolla repos, only copying
the files when an operator add their custom config.
Implements: blueprint custom-policies
Change-Id: Icf3c961b87cbc7a1f1dd2ffbfffcf271d151d862
This will solve the following issue:
WARNING oslo_config.cfg [-] Option "auth_plugin" from group "trustee"
is deprecated. Use option "auth_type" from group "trustee".
Change-Id: I7343a4a28555495d22a7960bf4d585152505a79c
Closes-bug: #1632064
"project_domain_id" and "project_name"
cannot be specified [trustee] section or keystone will throw a
"cannot be scoped to multiple targets" error when we attempt to get
a token scoped to a trust.
Change-Id: I167c0e31835d05b8069fd931ef76fb337dd99207
Closes-Bug: #1628353
do_reconfigure.yml is introduced to use serial directive. But we use
it in wrong. Now serial has moved to playbook file. So it is time to
remove the do_reconfigure.yml file
Closes-Bug: #1628152
Change-Id: I8d42d27e6bc302a0e575b0353956eaef9b2ca9fd
Useful for upgrade etc., which is preferablly done serially.
Example usage: tools/kolla-ansible deploy OR tools/kolla-ansible upgrade
Closes-Bug: #1576708
DocImpact
Change-Id: I34b2e16f8ce53e472a4682a4738c4ac0f5abf00c
Use a lower number of workers rather than the default value, which is
equal to the number of the cpu. Otherwise, in a multi cpu environment,
the number of the processes will very high.
In this PS, we use min(5, << number of cpu >>) as the default worker
count.
Closes-Bug: #1582254
Change-Id: I1c32cf0db794b43b8fb8be18f39190422ca5846f
Changed the order of the 'when' statements in "remove/restart
containers" tasks. It will fix the reconfiguration problem when
deploying different components on different hosts.
Change-Id: Ibee9dd56b6128b664144deb1d9eb7ec32e39fd5c
Closes-Bug: #1603943
An operator may want to specify the location of custom config
files so that kolla can detect their location and merge
them with the default configs generated.
Partially implements: blueprint multi-project-config
Change-Id: Ibfb38d07a36dfa7fe25381adc34cc1d3cbe7d1e1
This change makes each step of the kolla deployment aware
of the port database was configured to listen on.
It defaults mariadb_port to database_port.
Change-Id: I8e85d5732015afc0a5481cb33e0b629fdfa84a1b
Closes-Bug: #1576151
DocImpact
Make sure that all the sevices will attempt to
connect to the database an infinite about of times.
If the database ever disappears for some reason we
want the services to try and reconnect more than just
10 times.
Closes-bug: #1505636
Change-Id: I77abbf72ce5bfd68faa451bb9a72bd2544963f4b
This reverts commit 7524b3770fedd730bf2c49d26a94135c5357781b.
Liberty uses heat_user_domain and works and this should too. The
bootstrap process itself must have changed or another part of the
config. Either way that needs to be fixed so we can do proper upgrades.
Basically, dont change the heat domain out from under the user).
Change-Id: I32ae3ef90d340a83b09c09860af8f3635c1a07a5
