This change adds support for configuration of Apt package manager in
/etc/apt/apt.conf.d/. This allows adding arbitrary global configuration
options for Apt. Options can be added in different files, allowing for
different filename-based priorities.

CI tests and documentation are provided.

Story: 2009655
Task: 43987

Change-Id: I9d7d18851359e97cd01b4c2287bf79110796b25a

This change adds support for configuring Apt repositories on Ubuntu
hosts during host configuration.

Repositories are configured in a single file
(/etc/apt/sources.list.d/kayobe.sources), using the modern deb822
format [1]. This format is more flexible and readable than the original
single-line format, particularly if multiple options are used.

Using a single file allows us to more easily keep the set of
repositories in sync, since Ansible doesn't make it easy to clean things
up.

Support is added for marking repositories as signed by a particular GPG
key. This approach is now preferred over the deprecated [2] apt-key
tool, which resulted in a set of globally trusted keys.

It is also possible to disable the repositories in
/etc/apt/sources.list via apt_disable_sources_list. This allows for
replacing the standard repositories with a local mirror.

CI tests and documentation are provided.

[1] https://manpages.ubuntu.com/manpages/focal/en/man5/sources.list.5.html
[2] https://manpages.ubuntu.com/manpages/groovy/man8/apt-key.8.html

Story: 2009655
Task: 43818

Change-Id: I3f821937b0930a0ac9341178de7ae5123d82b957

The release of pytest-metadata 2.0.0 appears to have broken the molecule tests.

  AttributeError: 'Config' object has no attribute '_metadata'

Change-Id: I60cf89ce2f8c236b7febb92d437abf7e21bb7acd

Since I4fb42d376636dc363cd86950ed37de4a3d28df73, kolla-ansible sets
kernel_append_params in ironic.conf, instead of the deprecated
pxe_append_params. Make the same change in the Kayobe ironic.conf
template, to avoid getting shadowed by the kolla-ansible default.

This also fixes the overcloud TLS job, which started failing because it
lost the ipa-insecure kernel option, making the Ironic API callback
invalid.

Change-Id: Id7e4bd7f199ad9dcb21d5db082e7a187cb310df9

Change-Id: If7d6e58b19f98ccb7cc4c209e458cb6f4f4765ad

Sometimes some hosts should be configured with an interface without any
IP address set (e.g. bridged interface) and to achieve that this change
adds the new attribute 'no_ip' for the network configuration. Also the
change contain a test for this.

Change-Id: I2c9dfeca7f0d37a96f9cbd9df51d94098cf07258
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Any interface not matching the convention: <interface>.<vlan id> will be
assumed to untagged when generating the config drive. The link type will
be set to `phy` in `network_data.json` instead of `vlan`. This prevents
invalid config drive configuration from being generated.

Change-Id: I00e7615581c7a214e0ee8e8f04cacdbb3ea4131a
Story: 2009910
Task: 44736

Change If483a6a6fb6d5b2c9b6b7dbd22939b0b46599538 which fixed the job
should have included this bit.

Change-Id: I22e2e6d361bc15fe7aa47ff833b3c5a525266221

Change-Id: I3d6a703f74a662ca28022fe44ca936c192c7e89e

The molecule job is failing with the following since the release of
ansible-lint 6.0.0:

    ModuleNotFoundError: No module named 'ansiblelint.prerun'

Pin ansible-lint to <6.

Also ignore changes to molecule-requirements.txt for jobs that don't use
it.

Change-Id: I00ea1b4cd57a22a1a0939ddc463ef336da2f0902

We build IPA images and a deployment image in the seed jobs, so we don't
need to download Cirros or IPA images. Also, these downloads depend on
external resources which may make jobs less reliable.

For seed upgrade jobs, disable IPA and deployment image downloads.

Change-Id: Ib59c8bc2d8938eca18c943bb2e66ed185152a739

The kayobe-seed-ubuntu-focal job is currently fairly unreliable, often
failing to build the base container image.

We are not using the mirrors provided by OpenDev infra, which may be
making these builds less reliable.

This change disables container image builds in CI on Ubuntu. It should
be reverted if they are made more reliable.

Change-Id: I648fa6423ad9ff43120c7808f080b0359ad8621c

When TLS is enabled, extra RAM usage is causing the OOM killer to
terminate Tenks VMs, which are using large RSS amounts (around 1.5 GB).

Disable Heat and Horizon to free up enough memory to make the job pass.

Change-Id: If483a6a6fb6d5b2c9b6b7dbd22939b0b46599538

The overcloud job with TLS is failing frequently with the Tenks VM
triggering the OOM killer. Disable until we find a reliable fix.

Change-Id: If42d1f0580d8305a36dd4fd4431680559eb5d68f

These are only neccesary on network and compute nodes.

Co-authored-by: Mark Goddard <mark@stackhpc.com>

Change-Id: Id5af3969da63150e892201f7518f50a3da73e852
Story: 2009911
Task: 44740

The update of MichaelRigart.interfaces to v1.13.0
introduced a regression due to
https://github.com/michaelrigart/ansible-role-interfaces/pull/118.

Configuration for active interfaces could be removed and not recreated,
if not present in the kayobe network interface configuration. This
affects the Kayobe development environment, in which the configuration
does not touch the host's real network interfaces. That would lead to
DHCP leases not being renewed, and consequent loss of access to the
host.

This change fixes the issue by bumping to v1.13.1, which reverts the
change.

Change-Id: I03da729e1d05783af2e290237485f6035d2ddcdc

Change-Id: I615707976454a91c8f6aecc5eda1852def7197d4

nova-libvirt images now include qemu-utils on master [1] and xena [2].

[1] https://review.opendev.org/c/openstack/kolla/+/830401
[2] https://review.opendev.org/c/openstack/kolla/+/831411

Change-Id: I8f5f93340642d055cce7ef306d942e75b10c86a9

Depends-on: https://review.opendev.org/c/openstack/bifrost/+/819785
Change-Id: I37b9d18f0523c121357c5a37ec6fc458209f8e79

Previously we were using the zuul user in the TLS jobs. This was due to
a permissions issue when accessing the CA certificate in kayobe-config
in the zuul user's home directory.

This change reverts to the default of using the stack user for the TLS
jobs. In order to make this work, the generated CA cert chain is added
to the trust store.

Change-Id: I875f8976df75dee68ba00842fe624c29cc1b123c

Change-Id: Iaec4c530c353f7b97209a205473601abb0a408f4

This was removed from Kolla during the Yoga release cycle.

Change-Id: I0d2fba4e23ba49dec5adc9a822af2afe09111b58