4284 Commits

Author SHA1 Message Date
Mark Goddard
e13815c7b0 Stabilise Bifrost CI job
The Bifrost CI job seems quite unstable, often failing while attempting
to reach the public epel package repositories. We shouldn't need to
install any packages when deploying the container - they should all have
been installed in the image already.

This change avoids running the scripts/env-setup.sh script, which is run
when the container image is built.

It also removes sourcing of /opt/stack/ansible/hacking/env-setup, which
is now just a stub.

Change-Id: I1786e5337a397cb7b427d6b87c21eaee600af170
2018-08-02 14:56:55 +01:00
Zuul
94d04c6a68 Merge "Allow configuring a gateway for the inspection network" 2018-08-01 13:53:29 +00:00
Zuul
7008eb39ba Merge "Bump ansible_version_min to 2.4" 2018-08-01 09:33:37 +00:00
Eduardo Gonzalez
5d25f77fcc Fix magnum api dimensions
Change-Id: Ibb7d6981d9d7fed2293af6533e54fb9c768cace6
Closes-Bug: #1784497
2018-07-31 08:27:40 +02:00
Zuul
23c31eb312 Merge "Enable chrony container by default" 2018-07-31 03:21:52 +00:00
caoyuan
0dd487fdb1 Bump ansible_version_min to 2.4
the include_tasks is the new feature in version 2.4[0], and
kolla use it[1], the ansible_version_min should be updated
to version 2.4

[0]: https://docs.ansible.com/ansible/2.4/include_tasks_module.html
[1]: https://review.openstack.org/#/c/584728/

Change-Id: I273ac9e8295bfe3fb97af620c1e48e9fbbf06c6e
2018-07-30 08:38:39 +08:00
wu.chunyang
da9ff22461 Use include_tasks instead of include
last patch have replaced include by include_tasks, but here have a
 omission

Change-Id: Ibfe2918eb5504bb5355489ab093200feb1d221d7
2018-07-27 22:58:21 +08:00
Zuul
3e45b2cbec Merge "Use include_tasks instead of include" 2018-07-27 08:16:08 +00:00
Zuul
2744a79844 Merge "Bifrost: set TFTP cache master path properly" 2018-07-27 07:32:57 +00:00
Zuul
ffb8e2835d Merge "Fix monasca auth variable" 2018-07-27 07:03:32 +00:00
Zuul
cd03876e7d Merge "Apply Resource-Constraints to all services." 2018-07-26 14:18:39 +00:00
Zuul
82437285a1 Merge "Apply Resource Constraints to Services." 2018-07-26 14:18:35 +00:00
Zuul
d1e427b7c1 Merge "Apply Resource Constraints to Openstack Services" 2018-07-26 14:18:34 +00:00
Zuul
b398cb2f66 Merge "Fix ceph role with ansible < 2.4" 2018-07-26 14:15:00 +00:00
Lakshmi Prasanna Goutham Pratapa
14bf524756 Apply Resource Constraints to Services.
This commit is to apply resource-constraints to a few more OpenStack services.
Commit to  apply constraints to the last set of services will be made in
the upcoming commit.

Depends-on: Icafa54baca24d2de64238222a5677b9d8b90e2aa
Change-Id: I39004f54281f97d53dfa4b1dbcf248650ad6f186
2018-07-26 11:35:28 +00:00
Doug Szumski
0415943a37 Fix monasca auth variable
Perform the refactoring of the auth field from change #552863

TrivialFix
Partially-Implements: blueprint monasca-roles

Change-Id: I0a87cc3cb40df5e1c927bcd8ff4bd33e44fe4172
2018-07-26 09:20:26 +00:00
Zuul
c724865674 Merge "Fix action -> kolla_action for ironic-neutron-agent" 2018-07-26 09:15:10 +00:00
Mark Goddard
d95c87cf01 Fix action -> kolla_action for ironic-neutron-agent
Ironic Neutron Agent was added by
I92b9505843f12692aef96764a314e5db49001a9b.

Change-Id: Ib178bafc9907537fdd46dd374684b037db7f19df
TrivialFix
2018-07-26 07:44:10 +01:00
Mark Goddard
07b64dedc1 Fix ceph role with ansible < 2.4
The include_tasks action was added in ansible 2.4.

Change-Id: Ieac4a39a95c6aa55754c9dde5e94fb293c103caa
Related-Bug: #1783456
2018-07-25 20:57:23 +01:00
Zuul
6c75aedac3 Merge "Fix sudoers in bootstrap-servers when user != group" 2018-07-25 19:46:56 +00:00
Mark Goddard
69c1bf2d82 Allow configuring a gateway for the inspection network
This is configured via the ironic_dnsmasq_default_gateway variable, and
is not set by default.

Change-Id: I4deea65876d0852ba2b48a8cf9bad94f4df2a18d
2018-07-25 18:15:08 +00:00
Zuul
294237dfae Merge "Make sudoers config optional in bootstrap-servers" 2018-07-25 17:25:25 +00:00
Lakshmi Prasanna Goutham Pratapa
76210a2d85 Apply Resource Constraints to Openstack Services
This commit is to apply resource-constraints only to few OpenStack services.
Commit to apply constraints to other services will be made in coming commits.

Partially-Implements: blueprint resource-constraints

Change-Id: Icafa54baca24d2de64238222a5677b9d8b90e2aa
2018-07-25 17:05:04 +01:00
Jeffrey Zhang
b51eeed89e Use include_tasks instead of include
include is marked as deprecated since ansible 2.4[0]

[0] https://docs.ansible.com/ansible/2.4/include_module.html#deprecated

Co-Authored-By: confi-surya <singh.surya64mnnit@gmail.com>
Change-Id: Ic9d71e1865d1c728890625aeddf424a5734c0a8a
2018-07-25 23:57:22 +08:00
Zuul
3e5d3f94e9 Merge "Improve ceph-rgw compatibility with Swift API in Kolla-ansible" 2018-07-25 15:46:02 +00:00
tone.zhang
2ce46e4767 Improve ceph-rgw compatibility with Swift API in Kolla-ansible
By default ceph-rgw is not completely comaptible with Swift API,
because of the restriction for Swift INFO API.[0]

The patch improve ceph-rgw compatibility with Swift API. It is
controlled by the option "ceph_rgw_compatibility" in
ansible/group_vars/all.yml.

After changing the option, run the "reconfigure" command to enable.

Closes-Bug: #1783456

[0] https://github.com/ceph/ceph/pull/17967

Change-Id: Ibf3eb52280e197965caef08a44ae226c4f884cb5
Signed-off-by: tone.zhang <tone.zhang@arm.com>
2018-07-25 18:09:23 +08:00
wu.chunyang
f9209e1a70 Add when condition to freezer role
freezer's deploy.yml do not have when condition,here to add it.

Change-Id: Id275a5eb746783694248a6db5b7f3ee7b8b3b8c5
2018-07-25 07:34:09 +00:00
Zuul
80b8d2da25 Merge "Add networking-baremetal configuration" 2018-07-24 18:13:00 +00:00
Zuul
4b8f17cd82 Merge "Extending designate named template to include "forwarders" parameter" 2018-07-24 04:07:41 +00:00
Will Miller
5dd080a130 Add networking-baremetal configuration
Partially-Implements: blueprint networking-baremetal

Change-Id: I92b9505843f12692aef96764a314e5db49001a9b
2018-07-23 16:36:04 +01:00
Lakshmi Prasanna Goutham Pratapa
9f0db30fd1 Apply Resource-Constraints to all services.
This commit is the final commit to apply resource-constraints
to all OpenStack services.

Depends-on: I39004f54281f97d53dfa4b1dbcf248650ad6f186
Change-Id: I072d69be9698be54775cb0ae286ea2b6ed78776c
Implements: blueprint resource-constraints
2018-07-23 19:07:05 +05:30
Zuul
d14f420ad0 Merge "Cinder fails to run because snapshots are not compatible with secure NAS" 2018-07-23 08:59:10 +00:00
Mark Goddard
83595f78dd Fix typo in nova rp_filter sysctl
Fixes a typo introduced in I93e53bad9727beb786b00bd7fcd6d78785c619c2.

Change-Id: I9fd6587913cccd5a29b3fc012b4ddeac8859a0ff
Related-Bug: #1782799
TrivialFix
2018-07-23 08:22:25 +01:00
Zuul
c83e9d194b Merge "Disable TLS 1.1 on haproxy" 2018-07-23 06:38:11 +00:00
Zuul
f7101cd41b Merge "Support setting rp_filter mode" 2018-07-23 05:35:35 +00:00
Zuul
651ba52d7d Merge "Add support for onos" 2018-07-23 03:06:58 +00:00
Doug Szumski
264866ca2b Support setting rp_filter mode
Enables setting rp_filter mode on Neutron L3 agent and Nova compute
hosts whilst maintaining the default that it is disabled.

Closes-Bug: #1782799
Change-Id: I93e53bad9727beb786b00bd7fcd6d78785c619c2
2018-07-20 16:41:00 +01:00
Zuul
f111054b35 Merge "Fix monasca use of "action" -> "kolla_action"" 2018-07-20 14:11:03 +00:00
Zuul
8ce120159c Merge "Allow disabling nova-ssh" 2018-07-20 10:58:14 +00:00
Kevin Tibi
16df54eaa5 Disable TLS 1.1 on haproxy
While it is possible to implement countermeasures against some attacks
on TLS, migrating to a later version of TLS (TLS 1.2 is strongly
encouraged) is the only reliable method to protect against
the current protocol vulnerabilities.[1]

[1] https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls

Change-Id: I44f67e3a49bb00fea069d29c46b3e86404c7df0b
2018-07-20 11:10:33 +02:00
Joshua Harlow
07dfc20292 Allow externally managed swift as glance backend
It is possible to have an accessible swift API that is not managed by
kolla-ansible -- for example, ceph exposes a swift API, and using that
requires setting swift as the glance backend.

So, we should loosen the requirement that using the swift backend for
glance requires swift be enabled in kolla-ansible.

Co-Authored-By: Adam Harwell <flux.adam@gmail.com>

Change-Id: I17076d5412d2b1e1f13bb0badceaca85a5cee108
2018-07-20 08:55:57 +00:00
Zuul
003a6a12b1 Merge "remove uid, gid from rsyncd.conf for swift user" 2018-07-20 08:43:56 +00:00
Zuul
0b70070fc4 Merge "dev mode: Add support for trove" 2018-07-20 08:43:55 +00:00
Zuul
dfca923bd5 Merge "Apply Ironic rolling upgrade logic" 2018-07-19 11:39:05 +00:00
Adam Harwell
54a98c1155 Fix monasca use of "action" -> "kolla_action"
The word "action" is now an Ansible reserved word, and things have
transitioned to "kolla_action", but looks like this was missed.

Change-Id: Ie07a2a7d8b153a6d39b91129256727157f8dfa34
2018-07-19 01:45:07 -07:00
Zuul
b699413aba Merge "Fix glance config copy when a service is disabled" 2018-07-19 03:14:00 +00:00
Adam Harwell
8cc97c60d3 Fix glance config copy when a service is disabled
In this patch, the glance-registry service was disabled:
https://review.openstack.org/#/c/566804/

However, the config task still tries to copy files for it, which will
break due to path errors.

Change-Id: If39bb12bf830e6559342037ae2a2b99a784ee503
2018-07-18 14:08:40 -07:00
Zuul
57c9155004 Merge "Added delay_auth_decision config option for swift" 2018-07-18 17:07:01 +00:00
Zuul
60a4780d94 Merge "Make nova nova_instance_datadir_volume configurable." 2018-07-18 17:07:00 +00:00
Minho Ban
ecc1e4a6eb remove uid, gid from rsyncd.conf for swift user
The rsync prior to v3.1.0 the uid/gid parameter have no effect at
all if it runs as normal(non-root) user.

Since v3.1.0 these parameter are problematic for normal user
because now rsync, regardless of root or non-root, if the
parameters are given then it just tries to call setgroups() which
is not possible for normal user so errors may occur.

    swift-object-replicator: @ERROR: setgroups failed\u0000
    swift-object-replicator: rsync error: error starting
    client-server protocol (code 5) at main.c(1648)
    [sender=3.1.2]\u0000

Either way, these parameters are not needed for swift-rsync
container.

Change-Id: Ia7fe9f06d7a21a55f52b90c2cc1b2498300e6532
Signed-off-by: Minho Ban <mhban@samsung.com>
2018-07-18 09:17:12 +09:00