2746 Commits

Author SHA1 Message Date
Zuul
6afb3e19e9 Merge "Implement missing security context template for daemonjob-controller" 2020-09-10 17:27:21 +00:00
Zuul
acb8f20bf1 Merge "[ceph-osd] Allow logical disk labels to change for Ceph OSD disks" 2020-09-10 17:27:20 +00:00
KHIYANI, RAHUL (rk0850)
1336208632 Implement missing security context template for daemonjob-controller
This change adds security context template at container level

Change-Id: I72b1d5678e1fd3464b73937a2c50362bde8ae1d5
2020-09-10 10:21:14 -05:00
Zuul
35235d1532 Merge "Upgrade etcd to 3.4.3" 2020-09-10 07:26:13 +00:00
Zuul
eab20578ef Merge "Add default reject rule at the end in Postgres pg_hba.conf to ensure all connections must be explicitly allowed." 2020-09-10 02:52:09 +00:00
diwakar thyagaraj
ffb4781445 Upgrade etcd to 3.4.3
Change-Id: I6a9e225c1acb3f7cfeadd601fa4f2abb37e133f3
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
2020-09-09 16:29:02 +00:00
Stephen Taylor
b4d485b8ad [ceph-osd] Allow logical disk labels to change for Ceph OSD disks
This change allows Ceph OSDs to respond to logical disk changes
and continue to function instead of failing to initialize after
such a change. For example, /dev/sdd is deployed as an OSD disk
and then subsequently becomes /dev/sde due to a hardware-related
event. This change allows the OSD to adapt and run as /dev/sde.

Change-Id: I6c22088b8d884f9dd300d026415fb126af4b41d4
2020-09-09 15:24:44 +00:00
Steven Fitzpatrick
c336d93530 Alerta: Fix secret name and overrides
Change-Id: I0267b93abda3c7eff1d7d85cc220c34ff2b75465
2020-09-09 05:17:16 +00:00
Steven Fitzpatrick
4ec7fdc7e6 Alerta: Fix files with CRLF eol characters
Change-Id: I30a6dbb8b2aaf8a1e944530426995457b59a4c9a
2020-09-09 05:12:54 +00:00
KHIYANI, RAHUL (rk0850)
cb1bd3c6d7 Add security context template at pod/container level for etcd chart
This change implements runAsUser flag at pod level and readOnly-fs
flag at container level

Change-Id: Idcb78a1125b51e3b2a71c8cab0e97246c3f1c5aa
2020-09-08 19:25:32 +00:00
Andrii Ostapenko
094acf9c86 Support old mariadb dump file naming
Fallback to old dump file naming for read operation to support archives
with legacy naming.

Change-Id: I0c9c7b2c1feaac9aca817041dae617b4d1056b84
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-09-04 00:53:37 +00:00
diwakar thyagaraj
6dd08e84ca Add Zuul Jobs for apparmor to alerta and Prometheus black-box
1)Moved Apparmor changes to overides so as to use experimental Jobs.
2)Changed Numerical Convention to openstack exporterw

Change-Id: I9ac1f6399c09fc54fcdb98eb0c6cf91912bc93c1
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
2020-09-03 13:28:24 +00:00
Gnana Lakshmi Kilambhi (gk118g)
982e3754a5 Add default reject rule at the end in Postgres pg_hba.conf to ensure all connections must be explicitly allowed.
default reject at the end of pg_hba.conf is added to ensure all connections must be explicitly allowed.
List of dependant users are added to allow connections are: 
1. postgresql-admin
2. postgres
3. psql_exporter

Change-Id: Ic7bd19e5eb4745b91d94d5a88851280054459547
2020-09-03 12:53:17 +00:00
KAVVA, JAGAN MOHAN REDDY (jk330k)
dc58ef9ddd Move Tiller version to 2.16.9
Update Helm chart for Armada to use Tiller version 2.16.9.

Change-Id: I6556a6e2a1fad3946a92da5e8dd97e0da5803c62
2020-09-02 08:05:00 -05:00
Zuul
fd49d0a4e7 Merge "Run metacontroller from 34356 user" 2020-09-01 20:25:17 +00:00
anthony.bellino
96369491cb Patroni exclusion for Postgres
This PS removes the previously put in place HA clustering support
Patroni provided.

Change-Id: I03ed11282413a454062ab34b8594ba60ac2175aa
2020-08-31 18:02:37 +00:00
KHIYANI, RAHUL (rk0850)
3b2a93f642 Run metacontroller from 34356 user
This adds the runAsUser flag to metacontroller at pod level

Change-Id: I347bf34e35ee60a17cb234819a3b8b870e0edb5b
2020-08-28 18:14:49 +00:00
Tin Lam
303d5e3108 fix(tls): addresses TLS issues with mariaDB exporter
This patch fixes following issues:

1. The existing envvar DATA_SOURCE_NAME overrides the setting specified
in the mysql_user.cnf file, ignore setting placed there;

2. Version 0.10 of the exporter does not support TLS, moving this to
minimally 0.11; and

3. Changed the host to the internal long name rather than the short
name.

Change-Id: I7259d23391ed31c423d74a8d9dc002e597adfb95
Signed-off-by: Tin Lam <tin@irrational.io>
2020-08-28 12:41:47 -05:00
Zuul
818157dcbb Merge "Remove race condition for monitoring job" 2020-08-27 15:56:19 +00:00
Zuul
5e7bd24fa0 Merge "Allow the storage.tsdb.wal-compression flag to be available" 2020-08-27 15:56:17 +00:00
Zuul
4e162e463d Merge "Overriding apparmor profile in values.yaml" 2020-08-27 14:59:31 +00:00
Andrii Ostapenko
9e993caf2b
Remove race condition for monitoring job
Alerta depends on postgresql. Since no dependency is specified on chart
level, move alerta to the next parallel script set.

Change-Id: Ia368444b6216010cb43b4d4dd817123a02338641
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-08-27 08:19:37 -05:00
PrateekDodda
421b73af3a Overriding apparmor profile in values.yaml
Template is already added here:
https://github.com/openstack/openstack-helm-infra/blob/master/prometheus-blackbox-exporter/templates/deployment.yaml#L35

Change-Id: Ia32969d97b439119e8a2f2aca796f6585747e5fa
2020-08-26 10:54:43 -05:00
Zuul
9e9d40b1ab Merge "updating apparmor profile to runtime/default" 2020-08-26 15:46:51 +00:00
Smith, David (ds3330)
9027d1337f Allow the storage.tsdb.wal-compression flag to be
available

Change-Id: I609414330f0c8a65b6c0d3409bded09fcff0bbe0
2020-08-26 15:42:24 +00:00
KHIYANI, RAHUL (rk0850)
98dbc6dfef Add security context template to prometheus-blackbox-exporter
This change adds security context template at pod level to implement
runAsUser flag

This change adds security context template at container level to implement
readOnly-fs flag

Change-Id: Icbea3487c058d88188061d0d5a77458dce910884
2020-08-26 00:02:06 +00:00
Yadav, Satender (sy336r)
c4d7b70b91 updating apparmor profile to runtime/default
Change-Id: I53f3f7d13ad18ce50c994e34d0f6cd7d3a92452c
2020-08-25 18:57:39 -05:00
Zuul
f29707dea2 Merge "Un-hardcode restartPolicy for ks-* jobs" 2020-08-25 23:53:08 +00:00
diwakar thyagaraj
30afcad5a2 Add Apparmor to Prometheus alert manager and snmp-notifier
1) Added to service account name insted of traditional pod name
   to resolve for dynamic release names.
2) Added Apparmor Job to Prometheus Alert Manager.

Change-Id: Ib65f721c5b99b3ae3d3af924ca5187ad6174ed20
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
2020-08-25 17:09:45 +00:00
Zuul
fab612ce94 Merge "Fix rabbitmq could not bind port to ipv6 address issue" 2020-08-25 15:51:51 +00:00
Zuul
3e582c8aa6 Merge "Updating promethious alertmanager container name to make it consistent" 2020-08-25 14:12:05 +00:00
Oleh Hryhorov
19ade859c2 Un-hardcode restartPolicy for ks-* jobs
The patch makes it possible to pass restartPolicy for jobs
which create different keystone resources.
However default behaviour is still the same and if restartPolicy
is undefined then it will be OnFailure as it was before.

Change-Id: I0e355cfd6947db72f77d76a0f6696e9bcef175e9
2020-08-25 08:36:27 +03:00
Zuul
d34ceee6bc Merge "Moving job_rabbit_init from static to dynamic deps" 2020-08-24 21:58:58 +00:00
Yadav, Satender (sy336r)
588d0f6db4 Updating promethious alertmanager container name to make it consistent
Change-Id: I0b4f0fb20f9f9ecdc3e07fcbba4395feb1d8c868
2020-08-24 16:03:34 -05:00
Zuul
12b97cbbf9 Merge "Add "alert.severities" flag to snmp-notifier" 2020-08-24 19:53:53 +00:00
Zuul
94932a3122 Merge "Fix calico chart for hyperkube 1.12" 2020-08-24 19:41:28 +00:00
Zuul
e94ecb7e8f Merge "[ceph-osd] enhancement to the "post-apply" job" 2020-08-24 19:06:58 +00:00
Xiaoguang(William) Zhang
c371890112 Add "alert.severities" flag to snmp-notifier
- Add "alert.severities" flag to snmp-notifier of Alertmanager
- Reogranize snmp-notifier flags.

Change-Id: I7e21241c8133289539b41a770e32a2fc1ae16c14
2020-08-22 22:36:55 -04:00
Chinasubbareddy Mallavarapu
8adc6216bc [CEPH] Disable ceph pg autoscaler on pools by reading from values
This is to disable unintentionally enabled pg autoscaler on pools
by reading it from values.

Change-Id: Ib919ae7786ec1d4cbe7a309d28fd6571aa6195de
2020-08-21 16:55:33 -05:00
Zuul
754d8e93b4 Merge "Add Alerta feature to osh-infra" 2020-08-19 21:19:18 +00:00
Xiaoguang(William) Zhang
83a55fd19e Add Alerta feature to osh-infra
Change-Id: Id8dc3f86b8d6754df4ba3c0c720a78731e3f54d5
2020-08-19 13:35:40 +00:00
Zhipeng Liu
a2c43262cf Fix rabbitmq could not bind port to ipv6 address issue
When we use amarda to deploy openstack service for ipv6, rabbitmq
pod could not start listen on [::]:5672 and [::]:15672.
For ipv6, we need do some override as below.
conf:
  rabbitmq:
    management.listener.port: 15672
    management.listener.ip: "::"
  rabbitmq_env: |
    SERVER_ADDITIONAL_ERL_ARGS="+A 128 -kernel inetrc '/etc/rabbitmq/erl_inetrc' -proto_dist inet6_tcp"
    CTL_ERL_ARGS="-proto_dist inet6_tcp"
  erl_inetrc: |
    {inet6,true}.

We have test pass on both ipv4 and ipv6 setup for StarlingX project.

Signed-off-by: Zhipeng Liu <zhipengs.liu@intel.com>

Change-Id: I7af840ecd8960f9f1aa3f38d155c6e1bd822cb6e
2020-08-19 18:44:01 +08:00
Zuul
f37f6f5c93 Merge "Add capabilitity to backup only a single database" 2020-08-19 03:16:15 +00:00
Kabanov, Dmitrii
badfff4d19 [ceph-osd] enhancement to the "post-apply" job
The PS adds changes which allow to count available OSDs and compare an amount
of "ready" OSDs with total quantity of OSDs. Also it allows to pass the check
if the amount of "ready" OSD is more then required ("required_percent_of_osds").
Otherwise, the check will fail (including the case when one or several pods
in the namespace are not ready after timeout.)

Change-Id: I3cf6dbc6393b62423ee5929167f03b8fc7bbac68
2020-08-18 21:39:02 +00:00
Parsons, Cliff (cp769u)
233197fc0b Add capabilitity to backup only a single database
This PS adds the capability to Mariadb and Postgresql to backup a
single database (as an optional parameter to the backup script).

Change-Id: I9bc1eb0173063638b2cf58465c063f602ed20bc1
2020-08-18 18:30:31 +00:00
Zuul
611fda0171 Merge "Ingress: Configure Default SSL Certificate" 2020-08-18 16:36:39 +00:00
Zuul
622bc4d972 Merge "Remove remaining test pods before new test run" 2020-08-18 16:21:00 +00:00
Huang, Sophie (sh879n)
ba601e0cba Add TLS handling for the retrieval of MariaDB grants
In this patchset, when TLS is enabled, command line options
are added to provide the needed certificates for the invocation
of pt-show-grants during the MariaDB backup process.

Change-Id: I38eacb27ee0051e96c9fb2ba62773e84725ee868
2020-08-17 18:10:32 +00:00
Zuul
1851b47fdf Merge "Add Application armor to Postgresql-backup pods" 2020-08-14 23:36:27 +00:00
Chinasubbareddy Mallavarapu
4214e85a77 [CEPH] Add missing ceph cluster name for helm tests
This is to export the ceph cluster name as environment variable
since its getting referred by scripts.
also to fix the query to get inactive pgs.

Change-Id: I1db5cfbd594c0cc6d54f748f22af5856d9594922
2020-08-14 16:09:19 -05:00