1889 Commits

Author SHA1 Message Date
Jan Gutter
ed3b27cc92 etcd: Add support for more scenarios
This commit addresses a few shortcomings in the etcd service:
  * Adding or removing etcd nodes required manual intervention.

  * The etcd service would have brief outages during upgrades or
    reconfigures because restarts weren't always serialised.

This makes the etcd service follow a similar pattern to mariadb:
  * There is now a distiction between bootstrapping the cluster
    and adding / removing another member.

  * This more closely follows etcd's upstream bootstrapping
    guidelines.

  * The etcd role now serialises restarts internally so the
    kolla_serial pattern is no longer appropriate (or necessary).

This does not remove the need for manual intervention in all
failure modes: the documentation has been updated to address the
most common issues.

Note that there's repetition in the container specifications: this
is somewhat deliberate. In a future cleanup, it's intended to reduce
the duplication.

Change-Id: I39829ba0c5894f8e549f9b83b416e6db4fafd96f
2023-11-28 18:43:56 +01:00
Zuul
db79eb0a55 Merge "Rename kolla_docker to kolla_container" 2023-11-28 12:06:09 +00:00
Zuul
5472fa729a Merge "Fix expose prometheus externally with single frontend" 2023-11-27 09:54:47 +00:00
Zuul
e50c99d1e1 Merge "Fix proxysql get mariadb_backup_database_password" 2023-11-23 14:52:29 +00:00
Zuul
d6844dc895 Merge "Fix an issue with prometheus scraping itself" 2023-11-23 02:44:46 +00:00
Zuul
bad6759ee4 Merge "Fix glance-api failed to start privsep daemon" 2023-11-22 15:37:17 +00:00
Zuul
449683c5aa Merge "Configure CloudKitty with Prometheus basic auth" 2023-11-22 11:24:45 +00:00
Zuul
84f0a37e49 Merge "Fix grafana prometheus datasource" 2023-11-22 08:47:22 +00:00
Will Szumski
2c9dc5da03 Fix expose prometheus externally with single frontend
Closes-Bug: #2043831
Change-Id: I010fabd255d93d5329de82af2b5d21c8fa7d93c4
2023-11-22 07:30:26 +00:00
Pierre Riteau
4131eb458d Configure CloudKitty with Prometheus basic auth
Closes-Bug: #2044226
Change-Id: I5e17152584b758c9ca4f1cc14520337f979584b7
2023-11-22 07:08:19 +00:00
Zuul
4e74d5964b Merge "Adding mariadb_port to wsrep sync status so alterative ports can be used" 2023-11-21 11:58:20 +00:00
Zuul
57a8ff033f Merge "Deprecate Masakari" 2023-11-21 07:32:17 +00:00
Zuul
bd63dfd1e4 Merge "Set HAProxy server timeout for openstack exporter" 2023-11-18 09:31:29 +00:00
Zuul
e89b474b16 Merge "Deploy Glance and Cinder Backup with S3 backend support" 2023-11-17 19:11:49 +00:00
Zuul
f4cd334b9f Merge "keystone: Add support for OIDC options" 2023-11-17 19:01:31 +00:00
Will Szumski
775fac2b10 Fix an issue with prometheus scraping itself
Closes-Bug: #2043829
Change-Id: Ic4cbaf592a2699d9c0312c575f68613c8681239f
2023-11-17 18:25:12 +00:00
Will Szumski
dfce510c0f Fix grafana prometheus datasource
See:
https://grafana.com/docs/grafana/latest/administration/provisioning/

Closes-Bug: #2043828
Change-Id: I9ed07dc8c995adddf6d89838cd515af93d10bd00
2023-11-17 18:10:04 +00:00
Matt Anson
8000550e02 Set HAProxy server timeout for openstack exporter
Set the openstack exporter HAProxy backend server timeout to
``prometheus_openstack_exporter_timeout`` to ensure that scrapes
that take longer than haproxy_server_timeout don't timeout.

Closes-Bug: #2006051
Change-Id: I44841a6b6fa5bf659cace06295d18c093ad7f927
2023-11-17 14:41:52 +00:00
Dr. Jens Harbott
9675347fec Deprecate Masakari
Since the CI is failing and there are no contributors working on fixing
this, we are deprecating the service.

Also mention other deprecations in the README.

Change-Id: Ifff11645f6b4682810c042a0421d1eb569ab0ede
2023-11-16 18:45:15 +01:00
Petr Slavchenkov
ef0f5a05c9 Fix proxysql get mariadb_backup_database_password
Implements: Kolla Ansible
Closes-Bug: #2043554
Change-Id: I5648a79b4aa1960f1984a5179e3dfc3f0982c709
2023-11-16 08:35:06 +00:00
Zuul
4b35b9d9a9 Merge "Fix OpenStack exporter scrape with internal TLS & FQDN" 2023-11-15 15:10:48 +00:00
fzakfeld
85be68126e keystone: Add support for OIDC options
Introduce keystone_federation_oidc_additional_options variable

Change-Id: I39b9f35dab6f4e3ac2fcb505aabd2589e6e2ca69
2023-11-15 15:49:35 +01:00
Martin Hiner
a13d83400f Rename kolla_docker to kolla_container
Changes name of ansible module kolla_docker to
kolla_container.

Change-Id: I13c676ed0378aa721a21a1300f6054658ad12bc7
Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>
2023-11-15 13:54:57 +01:00
Michal Nasiadka
cea076f379 Introduce oneshot docker_restart_policy
docker_restart_policy: no causes systemd units to not get created
and we use it in CI to disable restarts on services.

Introducing oneshot policy to not create systemd unit for oneshot
containers (those that are running bootstrap tasks, like db
bootstrap and don't need a systemd unit), but still create systemd
units for long lived containers but with Restart=No.

Change-Id: I9e0d656f19143ec2fcad7d6d345b2c9387551604
2023-11-14 15:17:50 +00:00
Zuul
e9dd15967b Merge "Add support for ansible-core" 2023-11-08 15:01:02 +00:00
Zuul
a599e91178 Merge "Set HORIZON_IMAGES_UPLOAD_MODE to direct by default" 2023-11-08 13:41:00 +00:00
Michal Nasiadka
bc203433f1 Add support for ansible-core
Collections version taken from official Ansible 7 package [1]
and limited to the same major version.

[1]: https://github.com/ansible-community/ansible-build-data/blob/main/7/ansible-7.7.0.yaml

Change-Id: I0f1ea9717397adc2d2c3215d74ec3759f351a57a
2023-11-08 09:52:20 +00:00
Will Szumski
37c2ab2aaa Support exposing prometheus_server externally
This avoids the need to use a proxy, or some other means, to connect to
Prometheus. This is disabled by default and can be enabled by setting
enable_prometheus_server_external to true.

Change-Id: Ia0af044ff436c2a204b357750a16ff49fcdfec45
2023-11-07 14:52:06 +00:00
Zuul
e3cdb8eb3d Merge "Add support for LetsEncrypt-managed certs" 2023-11-07 14:45:36 +00:00
Zuul
c799af8467 Merge "octavia: enable jobboard" 2023-11-07 13:28:17 +00:00
James Kirsch
5581a28253 Add support for LetsEncrypt-managed certs
Add support for automatic provisioning and renewal of HTTPS
certificates via LetsEncrypt.

Spec is available at:
https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https

Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347
Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
Implements: blueprint letsencrypt-https
Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106
2023-11-07 10:59:51 +01:00
Christian Berendt
76cb8574ee octavia: enable jobboard
Enable the jobboard feature for the Octavia amphora provider. This
requires Redis as a dependency, a precheck is added to ensure proper
configuration.

https://docs.openstack.org/octavia/latest/install/install-amphorav2.html

Change-Id: Iec3c8a4b4e257557dc8ec995c41d0ad7e88e13e2
2023-11-07 09:38:38 +00:00
Michal Nasiadka
82c0efd139 Set HORIZON_IMAGES_UPLOAD_MODE to direct by default
Change-Id: I4aa6dc90c6e6da6cd5fa94ad9ea02396e9c60a8b
2023-11-06 15:30:18 +00:00
Zuul
255ce5c11e Merge "prometheus: Fix etcd scrape when etcd uses TLS" 2023-11-02 09:19:57 +00:00
Zuul
8e302cc47d Merge "Improve grok pattern matching for apache logs" 2023-10-30 15:09:30 +00:00
Sergei Raiskii
9486e1d545 Deploy Glance and Cinder Backup with S3 backend support
Kolla Ansible should deploy Glance and Cinder Backup with
S3 backend support working out-of-the-box.

The S3 backend had been re-introduced in Ussuri after being
deprecated around the Mitaka timeframe, and having some local
object storage options is nice for testing..

Closes-Bug: #1977515
Change-Id: I4ca58382d1ee568bfca2ad108495422163f81260
Co-authored-by: Juan Pablo Suazo <jsuazo@whitestack.com>
Co-authored-by: Maksim Malchuk <maksim.malchuk@gmail.com>
2023-10-25 10:13:14 -03:00
Zuul
f34ec164a6 Merge "Add support of podman deployment" 2023-10-23 13:06:49 +00:00
Ivan Halomi
9a3f463345 Add support of podman deployment
This change adds basic deployment based on Podman
container manager as an alternative to Docker.

Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com>
Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>
Signed-off-by: Petr Tuma <p.tuma@partner.samsung.com>
Change-Id: I2b52964906ba8b19b8b1098717b9423ab954fa3d
Depends-On: Ie4b4c1cf8fe6e7ce41eaa703b423dedcb41e3afc
2023-10-20 17:51:52 +02:00
Laurie Fisher
63213c0e23 Improve grok pattern matching for apache logs
Apache grok pattern updated to match the size of response in bytes,
the time taken to serve the request and the user-agent that made
the request.

Change-Id: I8ce6e6e10bbf55ef8aa21f983f4a6c4b6dc24402
2023-10-13 14:03:56 +00:00
Rafal Lewandowski
ec11c31253 Add a separate interface address for tgtd
Closes-Bug: #2031237
Change-Id: I7a4eaeab0c106ebdcb4d4cf9825c53dd8ad62dbf
2023-10-05 13:27:28 +02:00
Bartosz Bezak
fc7deed9cd Default keystone user role changed to member
_member_ role is a long not used default keystone role,
for instance Horizon moved to use member role from yoga [1]

[1] https://docs.openstack.org/horizon/yoga/configuration/settings.html#openstack-keystone-default-role

Closes-Bug: #2038314
Change-Id: Idc9bce82c682e37c5bea10c93577091b85f3ad45
2023-10-04 11:07:09 +00:00
Michal Nasiadka
00dfa4233c Remove remnants of Monasca and deps
Following Monasca initial removal in [1]

[1]: I6fc7842bcda18e417a3fd21c11e28979a470f1cf

Change-Id: I94d6f102e8da3882f37f3007639b917c49f907a9
2023-10-02 13:10:03 +02:00
Zuul
fdc3b122c1 Merge "zun: Deprecate Zun provisionally" 2023-09-27 14:46:48 +00:00
Zuul
b422bada22 Merge "Add ML2/OVN and ML2/OVS setting checks for neutron" 2023-09-27 13:26:03 +00:00
Jan Gutter
f8d4db54db
zun: Deprecate Zun provisionally
* Zun currently has a dependency on a combination of Docker and
  etcd that is no longer installable (or supported) in newer
  distros.
* These components are core dependencies of other systems and
  vendoring them will be very painful.
* Work to update Zun past this is scheduled for the 'C' cycle.
* If Zun regains compatibility, backports to this series will be
  considered.

Change-Id: I6a2a4ffdcaf1c4fab1097e94d5f255ffb9a2947d
2023-09-26 21:48:12 +01:00
Rafal Lewandowski
d3d67dc02c Add ML2/OVN and ML2/OVS setting checks for neutron
It will check the setting of neutron_plugin_agent,
if it is set to "ovn" or "openvswitch", and run
container and volume checks to make sure the other
agent was not already deployed.

Change-Id: Ie00572f3ff9d3500abd5519bd472e2134c318886
2023-09-26 21:24:12 +02:00
Dincer Celik
f64c86de1d [haproxy] Adds http/2 support to HAProxy
This change introduces haproxy_enable_http2 to let operators enable
http/2 on HAProxy frontends when kolla_enable_tls_external is enabled.

Change-Id: I2e00d3e9193a3052d43a228915ea249794490afe
Closes-Bug: #1850924
2023-09-25 11:36:54 +02:00
Bartosz Bezak
7186f960d9 Add option for extra kernel modules in neutron role
Closes-Bug: #2036741

Change-Id: Ib448d04e43dff78e344064161beadae917c41206
2023-09-21 11:54:00 +00:00
Mark Goddard
05df4e7209 prometheus: Fix etcd scrape when etcd uses TLS
Use HTTPS to scrape etcd metrics when etcd TLS is enabled.

Change-Id: Iaff10d5314a8dc5b07137d93c269f1ac24cf63de
Closes-Bug: #2036950
2023-09-21 12:28:38 +01:00
Zuul
28ffebca93 Merge "debian: Remove kolla-ansible-debian-zun job" 2023-09-20 14:12:28 +00:00