Adds support for SASL authentication of libvirt TCP and TLS connections
when using a compute host libvirt daemon.

In line with the dependent Kolla Ansible patch, we enable SASL by
default, and use DIGEST-MD5 with TCP and SCRAM-SHA-256 with TLS.

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/833022
Depends-On: https://github.com/stackhpc/ansible-role-libvirt-host/pull/52

Story: 2009858
Task: 44735

Change-Id: Id3972c24022aeb6421494c3cccdc8e7cbce802e6

In some cases it may be desirable to run libvirt daemon on the host. For
example, when mixing host and container OS distributions.

This change makes it possible to disable the nova_libvirt container, by
setting kolla_enable_nova_libvirt_container to false.

The stackhpc.libvirt-host role is used in order to install and configure
a libvirt daemon on compute hosts when
kolla_enable_nova_libvirt_container is false.

Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/825357
Depends-On: https://review.opendev.org/c/openstack/kayobe-config-dev/+/829225
Depends-On: https://github.com/stackhpc/ansible-role-libvirt-host/pull/51

Story: 2009858
Task: 44495

Change-Id: I73fef63fb886a9d543d2f4231fb009523495edb3

This change adds support for configuration of Apt package manager in
/etc/apt/apt.conf.d/. This allows adding arbitrary global configuration
options for Apt. Options can be added in different files, allowing for
different filename-based priorities.

CI tests and documentation are provided.

Story: 2009655
Task: 43987

Change-Id: I9d7d18851359e97cd01b4c2287bf79110796b25a

This change adds support for configuring Apt repositories on Ubuntu
hosts during host configuration.

Repositories are configured in a single file
(/etc/apt/sources.list.d/kayobe.sources), using the modern deb822
format [1]. This format is more flexible and readable than the original
single-line format, particularly if multiple options are used.

Using a single file allows us to more easily keep the set of
repositories in sync, since Ansible doesn't make it easy to clean things
up.

Support is added for marking repositories as signed by a particular GPG
key. This approach is now preferred over the deprecated [2] apt-key
tool, which resulted in a set of globally trusted keys.

It is also possible to disable the repositories in
/etc/apt/sources.list via apt_disable_sources_list. This allows for
replacing the standard repositories with a local mirror.

CI tests and documentation are provided.

[1] https://manpages.ubuntu.com/manpages/focal/en/man5/sources.list.5.html
[2] https://manpages.ubuntu.com/manpages/groovy/man8/apt-key.8.html

Story: 2009655
Task: 43818

Change-Id: I3f821937b0930a0ac9341178de7ae5123d82b957

The release of pytest-metadata 2.0.0 appears to have broken the molecule tests.

  AttributeError: 'Config' object has no attribute '_metadata'

Change-Id: I60cf89ce2f8c236b7febb92d437abf7e21bb7acd

Currently, the 'kayobe * host package update' commands do not work on
Ubuntu, since the main task is skipped.

This change adds support for running the commands against Ubuntu hosts,
passing parameters to the package module based on the OS distribution.

Change-Id: I879df0ea3f357c2bb45a5e7331a3f2569eac63e9
Story: 2009685
Task: 43988

Since I4fb42d376636dc363cd86950ed37de4a3d28df73, kolla-ansible sets
kernel_append_params in ironic.conf, instead of the deprecated
pxe_append_params. Make the same change in the Kayobe ironic.conf
template, to avoid getting shadowed by the kolla-ansible default.

This also fixes the overcloud TLS job, which started failing because it
lost the ipa-insecure kernel option, making the Ironic API callback
invalid.

Change-Id: Id7e4bd7f199ad9dcb21d5db082e7a187cb310df9

Change-Id: If7d6e58b19f98ccb7cc4c209e458cb6f4f4765ad

Sometimes some hosts should be configured with an interface without any
IP address set (e.g. bridged interface) and to achieve that this change
adds the new attribute 'no_ip' for the network configuration. Also the
change contain a test for this.

Change-Id: I2c9dfeca7f0d37a96f9cbd9df51d94098cf07258
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Any interface not matching the convention: <interface>.<vlan id> will be
assumed to untagged when generating the config drive. The link type will
be set to `phy` in `network_data.json` instead of `vlan`. This prevents
invalid config drive configuration from being generated.

Change-Id: I00e7615581c7a214e0ee8e8f04cacdbb3ea4131a
Story: 2009910
Task: 44736

Change If483a6a6fb6d5b2c9b6b7dbd22939b0b46599538 which fixed the job
should have included this bit.

Change-Id: I22e2e6d361bc15fe7aa47ff833b3c5a525266221

Change-Id: I3d6a703f74a662ca28022fe44ca936c192c7e89e

The molecule job is failing with the following since the release of
ansible-lint 6.0.0:

    ModuleNotFoundError: No module named 'ansiblelint.prerun'

Pin ansible-lint to <6.

Also ignore changes to molecule-requirements.txt for jobs that don't use
it.

Change-Id: I00ea1b4cd57a22a1a0939ddc463ef336da2f0902

We build IPA images and a deployment image in the seed jobs, so we don't
need to download Cirros or IPA images. Also, these downloads depend on
external resources which may make jobs less reliable.

For seed upgrade jobs, disable IPA and deployment image downloads.

Change-Id: Ib59c8bc2d8938eca18c943bb2e66ed185152a739

The kayobe-seed-ubuntu-focal job is currently fairly unreliable, often
failing to build the base container image.

We are not using the mirrors provided by OpenDev infra, which may be
making these builds less reliable.

This change disables container image builds in CI on Ubuntu. It should
be reverted if they are made more reliable.

Change-Id: I648fa6423ad9ff43120c7808f080b0359ad8621c

When TLS is enabled, extra RAM usage is causing the OOM killer to
terminate Tenks VMs, which are using large RSS amounts (around 1.5 GB).

Disable Heat and Horizon to free up enough memory to make the job pass.

Change-Id: If483a6a6fb6d5b2c9b6b7dbd22939b0b46599538

The overcloud job with TLS is failing frequently with the Tenks VM
triggering the OOM killer. Disable until we find a reliable fix.

Change-Id: If42d1f0580d8305a36dd4fd4431680559eb5d68f

These are only neccesary on network and compute nodes.

Co-authored-by: Mark Goddard <mark@stackhpc.com>

Change-Id: Id5af3969da63150e892201f7518f50a3da73e852
Story: 2009911
Task: 44740

The update of MichaelRigart.interfaces to v1.13.0
introduced a regression due to
https://github.com/michaelrigart/ansible-role-interfaces/pull/118.

Configuration for active interfaces could be removed and not recreated,
if not present in the kayobe network interface configuration. This
affects the Kayobe development environment, in which the configuration
does not touch the host's real network interfaces. That would lead to
DHCP leases not being renewed, and consequent loss of access to the
host.

This change fixes the issue by bumping to v1.13.1, which reverts the
change.

Change-Id: I03da729e1d05783af2e290237485f6035d2ddcdc

Change-Id: I615707976454a91c8f6aecc5eda1852def7197d4

nova-libvirt images now include qemu-utils on master [1] and xena [2].

[1] https://review.opendev.org/c/openstack/kolla/+/830401
[2] https://review.opendev.org/c/openstack/kolla/+/831411

Change-Id: I8f5f93340642d055cce7ef306d942e75b10c86a9