6618 Commits

Author SHA1 Message Date
Zuul
dbb4f3d0ae Merge "Add neutron_ovn_availability_zones parameter" 2023-03-29 16:48:23 +00:00
Zuul
da48d99eef Merge "magnum: Fix trustee creation after ansible-collections-openstack bump" 2023-03-27 09:20:25 +00:00
Zuul
4971eccd62 Merge "Set RabbitMQ message TTL and queue expiry" 2023-03-24 16:28:43 +00:00
Zuul
ad744874c9 Merge "Add flags for RabbitMQ message TTL & queue expiry" 2023-03-24 16:20:29 +00:00
Michal Nasiadka
8dd409ceaf magnum: Fix trustee creation after ansible-collections-openstack bump
Change-Id: I54e68a3002d69f7b1be2704259c6a072f81aa586
2023-03-23 16:18:58 +00:00
Zuul
2845861ef9 Merge "Fix deploy/genconfig in check mode" 2023-03-23 10:55:24 +00:00
John Garbutt
fd30dfb867 Set RabbitMQ message TTL and queue expiry
Following ideas here:
https://wiki.openstack.org/wiki/Large_Scale_Configuration_Rabbit

Make sure old messages with no consumer are dropped after the message
TTL of 10 mins, longer than the 1 min RPC timeout.
Also ensure queues expire after an hour of inactivity, so queues from
removed nodes or renamed nodes don't grow over time.

Change-Id: Ifb28ac68b6328adb604a7474d01e5f7a47b2e788
2023-03-21 09:11:41 +00:00
Matt Crees
dae2cbca30 Add flags for RabbitMQ message TTL & queue expiry
Adds two new flags to alter behaviour in RabbitMQ:
    * `rabbitmq_message_ttl_ms`, which lets you set a TTL on messages.
    * `rabbitmq_queue_expiry_ms`, which lets you set an expiry time on queues.
See https://www.rabbitmq.com/ttl.html for more information on both.

Change-Id: I51ca37ffbb1bb5c07f2d39873f0f33ca20263f2a
2023-03-21 09:10:56 +00:00
Zuul
0d42110e01 Merge "Improve RabbitMQ performance by reducing ha replicas" 2023-03-20 12:17:42 +00:00
Zuul
13f4f78c6f Merge "Add flag to change RabbitMQ ha-mode definition" 2023-03-20 11:52:43 +00:00
Zuul
648870d275 Merge "RabbitMQ: Support setting ha-promote-on-shutdown" 2023-03-20 11:50:47 +00:00
Zuul
d6bfec4ad2 Merge "cloudkitty: set cafile for fetcher_keystone" 2023-03-20 10:41:19 +00:00
Michal Nasiadka
f5b3f9d22b ironic: fix dev mode for inspector
Change-Id: I1649a389bdc3977b936402c3ce3e55056d74ba08
2023-03-15 09:44:35 +00:00
Zuul
76268b7221 Merge "iscsi: Use assert on checks for readability" 2023-03-12 13:50:01 +00:00
Zuul
21e2434b59 Merge "etcd: Set the proper peer and client protocol when tls is enabled" 2023-03-09 08:06:05 +00:00
Christian Berendt
6768b760ab Add neutron_ovn_availability_zones parameter
With the new ``neutron_ovn_availability_zones`` parameter it is possible
to define network availability zones for OVN. Further details can be found
in the Neutron OVN documentation:
https://docs.openstack.org/neutron/latest/admin/ovn/availability_zones.html#how-to-configure-it

Change-Id: I203e0d400a3218d0b4a41f2a948207032c4febec
2023-03-06 13:28:28 +00:00
Matthew N Heler
5d3eed23a7 Set the etcd internal hostname and cacert for tls internal enabled
deployments

This allows services to work with etcd when coordination is enabled
for TLS internal deployments. Without this fix, we fail to connect to
etcd with the coordination backend and the service itself crashes.

Change-Id: I0c1d6b87e663e48c15a846a2774b0a4531a3ca68
2023-03-02 06:48:40 -06:00
Matthew N Heler
ee336ac45c etcd: Set the proper peer and client protocol when tls is enabled
Partial-Bug: #1930109

Change-Id: I383b2b5a139d24a419145473b66a34c06e32060a
2023-03-01 14:25:56 +00:00
Zuul
ad745bf1f8 Merge "hacluster: Use nodename to align with nova service names" 2023-02-22 20:38:43 +00:00
Zuul
ff0fca8fdc Merge "Switch trove-api to wsgi running under apache." 2023-02-20 16:46:42 +00:00
Matthew N Heler
e1ae8223f9 hacluster: Use nodename to align with nova service names
For Masakari and HACluster to work properly, the hostnames used
in HACluster need to match with the hostnames used in Nova.

Change-Id: Iac917ef4471905caab591cd64eab379e150a8524
2023-02-18 04:33:59 +00:00
Zuul
b1e5a97028 Merge "Use loadbalancer to connect to etcd" 2023-02-17 08:55:34 +00:00
Zuul
5ee602fcf1 Merge "ansible: Use assert on checks for readability" 2023-02-17 08:55:31 +00:00
Zuul
8f15011134 Merge "neutron: Use assert on checks for readability" 2023-02-17 08:55:28 +00:00
Zuul
4a0f058c54 Merge "rabbitmq: Use assert on checks for readability" 2023-02-17 08:40:25 +00:00
Zuul
b2dcfa0824 Merge "host_os: Use assert on checks for readability" 2023-02-17 08:39:24 +00:00
Mark Goddard
572ff2f8dc Fix deploy/genconfig in check mode
Previously, when running one of the following commands:

  kolla-ansible deploy --check
  kolla-ansible genconfig --check

deployment or configuration generation fails for various reasons.

MariaDB fails to lookup the existing cluster.

Keystone fails to generate cron config.

Nova-cell fails to get the cell settings.

Closes-Bug: #2002661
Change-Id: I5e765f498ae86d213d0a4379ca5d473db1499962
2023-02-14 17:18:16 +00:00
Zuul
0a128d24b9 Merge "Put etcd behind HTTP loadbalancer" 2023-02-14 11:31:09 +00:00
John Garbutt
6cf22b0cb1 Improve RabbitMQ performance by reducing ha replicas
Currently we do not follow the RabbitMQ advice on replicas here:
https://www.rabbitmq.com/ha.html#replication-factor

Here we reduce the number of replicas to n // 2 + 1 as advised
above. The hope it this helps speed up recovery from rabbit
issues.

Related-Bug: #1954925
Change-Id: Ib6bcb26c499c9884faa4a0cd51abaec00cacb096
2023-02-14 10:56:11 +00:00
Matt Crees
e13072a98d Add flag to change RabbitMQ ha-mode definition
Adds the flag `rabbitmq_ha_replica_count` to change how many different
nodes a queue should be mirrored across. If the value is not set, then
it defaults to "ha-mode":"all". This value is unset by default to avoid
any unexpected changes to the RabbitMQ definitions.json file, as that
would trigger an unexpected restart of RabbitMQ during the next deploy.

Change-Id: Iee98cd937197a73a3b04aa8501fa325e8ecfff24
2023-02-14 10:51:46 +00:00
Will Szumski
e2c7dace44 Use loadbalancer to connect to etcd
Hardcoding the first etcd host creates a single point of failure.

Change-Id: I0f83030fcd84ddcdc4bf2226e76605c7cab84cbb
2023-02-14 10:16:55 +00:00
Zuul
4ba17d6da4 Merge "loadbalancer: Use assert on checks for readability" 2023-02-13 16:19:50 +00:00
Zuul
ffa9c307b4 Merge "zun: Use assert on checks for readability" 2023-02-13 16:19:48 +00:00
Will Szumski
6f536a4f71 Put etcd behind HTTP loadbalancer
etcd-compatible tooz drivers do not support multiple endpoints via
backend_url. We can put a loadbalancer in front of etcd and configure
backend_url to use the VIP instead. The issue with hard coding the first
host is that we break coordination if we take this host offline. In the
case of cinder, we would not be able to perform any volume related
operations.

Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: Ib684501ba03c386dc5ac71e5cbea05c99f191665
2023-02-13 11:45:53 +00:00
Zuul
df12f2ce02 Merge "Default neutron_tls_proxy and glance_tls_proxy to haproxy_tag" 2023-02-10 14:47:49 +00:00
John Garbutt
94f3ce0c78 RabbitMQ: Support setting ha-promote-on-shutdown
By default ha-promote-on-shutdown=when-synced. However we are seeing
issues with RabbitMQ automatically recovering when nodes are restarted.
https://www.rabbitmq.com/ha.html#cluster-shutdown

Rather than waiting for operator interventions, it is better we allow
recovery to happen, even if that means we may loose some messages.
A few failed and timed out operations is better than a totaly broken
cloud. This is achieved using ha-promote-on-shutdown=always.

Note, when a node failure is detected, this is already the default
behaviour from 3.7.5 onwards:
https://www.rabbitmq.com/ha.html#promoting-unsynchronised-mirrors

This patch adds the option to change the ha-promote-on-shutdown
definition, using the flag `rabbitmq_ha_promote_on_shutdown`. This
value is unset by default to avoid any unexpected changes to the
RabbitMQ definitions.json file, as that would trigger an unexpected
restart of RabbitMQ during the next deploy.

Related-Bug: #1954925

Change-Id: I2146bda2c72ddac2c9923c6941b0596395fd9ab5
2023-02-09 13:49:07 +00:00
Zuul
75bd313678 Merge "Trivial: Add connection: local for keystone-fernet cron generate task" 2023-02-08 00:15:59 +00:00
Zuul
bc5e462143 Merge "remove elasticsearch remnants in antelope cycle" 2023-02-07 17:34:36 +00:00
Bartosz Bezak
ee658f4549 remove elasticsearch remnants in antelope cycle
Change-Id: I115b491eca413437926f5bcaf53336151f9a7c0b
2023-02-07 11:25:27 +01:00
wu.chunyang
303998e294 Switch trove-api to wsgi running under apache.
This change also adds support for Trove backend TLS.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/854744
Change-Id: I2acf7820b24b112b57b0c00a01f5c4b8cb85ce25
2023-02-02 01:22:59 +00:00
Michal Arbet
78cf9585b7 Trivial: Add connection: local for keystone-fernet cron generate task
This patch add connection local for above mentioned task as
kolla-ansible can be executed in docker container as in
my case.

When there is no connection: local, ansible is trying to connect
to localhost via ssh where specified python script is not available.

After connection: local everything is working as expected as file
is found inside container

Closes-Bug: #2004224

Change-Id: I219a958b4f101efb71a2935e6d910dae5c65f0be
2023-01-31 06:48:40 +01:00
yangshaoxue
113b77c8cb Add skyline service
Support to deploy skyline by kolla-ansible.

Implements: blueprint skyline
Depends-On: https://review.opendev.org/c/openstack/kolla/+/826948

Change-Id: Ice5621491a432ba32138abd6f62d1f815cc219e0
2023-01-31 13:47:18 +08:00
Bartosz Bezak
95895d5b06 Default neutron_tls_proxy and glance_tls_proxy to haproxy_tag
neutron_tls_proxy and glance_tls_proxy are using haproxy container
image. Pin them to haproxy_tag directly.

Change-Id: I73142db48ebe6641520d21b560f16de892e07c34
2023-01-30 16:45:56 +00:00
Zuul
66ec9cef55 Merge "Remove support for Ubuntu Focal 20.04 hosts" 2023-01-30 14:50:57 +00:00
Zuul
98139b0f10 Merge "Remove system scope token to access services" 2023-01-30 13:03:13 +00:00
Bartosz Bezak
6db6bc0a9f Remove support for Ubuntu Focal 20.04 hosts
Users running on a Focal host will now fail in prechecks.

Change-Id: Icaef4b25458490e46f623b055658abc678d2f1c6
2023-01-29 14:28:51 +00:00
Ghanshyam Mann
283fa242ca Remove system scope token to access services
As per the RBAC new direction in Zed cycle, we have dropped the
system scope from API policies and all the policies are hardcoded
to project scoped so that any user accessing APIs using system scope
will get 403 error. It is dropped from all the OpenStack services
except for the Ironic service which will have system scope and to
support ironic only deployment, we are keeping system as well as project
scope in Keystone.

Complete discussion and direction can be found in the below gerrit
change and TC goal direction:

- https://review.opendev.org/c/openstack/governance/+/847418
- https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#the-issues-we-are-facing-with-scope-concept

As phase-2 of RBAC goal, services will start enabling the new
defaults and project scope by default. For example: Nova did in
- https://review.opendev.org/c/openstack/nova/+/866218

Kolla who start accessing the services using system scope token
- https://review.opendev.org/c/openstack/kolla-ansible/+/692179

This commit partially revert the above change except keeping
system scope usage for Keystone and Ironic. Rest all services are changed
to use the project scope token.

And enable the scope and new defaults for Nova which was disabled
by https://review.opendev.org/c/openstack/kolla-ansible/+/870804

Change-Id: I0adbe0a6c39e11d7c9542569085fc5d580f26c9d
2023-01-26 17:52:00 -06:00
Zuul
38ccebb8cb Merge "Add systemd container control" 2023-01-25 18:43:47 +00:00
Zuul
99d1e3c710 Merge "Adding optional delay between l3 agent restarts" 2023-01-25 14:08:06 +00:00
Zuul
cab09e31dc Merge "Add ability to configure rabbitmq" 2023-01-25 11:20:23 +00:00