_member_ role is a long not used default keystone role,
for instance Horizon moved to use member role from yoga [1]

[1] https://docs.openstack.org/horizon/yoga/configuration/settings.html#openstack-keystone-default-role

Closes-Bug: #2038314
Change-Id: Idc9bce82c682e37c5bea10c93577091b85f3ad45

Following Monasca initial removal in [1]

[1]: I6fc7842bcda18e417a3fd21c11e28979a470f1cf

Change-Id: I94d6f102e8da3882f37f3007639b917c49f907a9

Followup on I2e00d3e9193a3052d43a228915ea249794490afe.
Fixes an issue with wrong copy/paste.

Related-Bug: #1850924
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Change-Id: I979a4e5b534f105a2e81f88f9675feddc883490a

* Zun currently has a dependency on a combination of Docker and
  etcd that is no longer installable (or supported) in newer
  distros.
* These components are core dependencies of other systems and
  vendoring them will be very painful.
* Work to update Zun past this is scheduled for the 'C' cycle.
* If Zun regains compatibility, backports to this series will be
  considered.

Change-Id: I6a2a4ffdcaf1c4fab1097e94d5f255ffb9a2947d

It will check the setting of neutron_plugin_agent,
if it is set to "ovn" or "openvswitch", and run
container and volume checks to make sure the other
agent was not already deployed.

Change-Id: Ie00572f3ff9d3500abd5519bd472e2134c318886

This change introduces haproxy_enable_http2 to let operators enable
http/2 on HAProxy frontends when kolla_enable_tls_external is enabled.

Change-Id: I2e00d3e9193a3052d43a228915ea249794490afe
Closes-Bug: #1850924

Closes-Bug: #2036741

Change-Id: Ib448d04e43dff78e344064161beadae917c41206

Change-Id: I901c0a57efcb6cbaaac43f64f2243fff7d7980c8

* keystone_enable_federation_openid
* enable_keystone_federation

Closes-Bug: #2036390

Change-Id: Ieef1dce006c339643ad4fa544218c6482c2ad32c

Allow more flexibility by adding a host specific template. Also
using the merge_yaml action allow us to drop the logic around deciding
which template to use.

Change-Id: I41a3226679c622e5e98df074cee195e8436ea45b

Initially Ubuntu/Debian used /var/run/openvswitch as default OVN run dir,
it seems it has changed long time ago - but we haven't picked that up on latest
OVN DB refactor.

Adding in OVN and OVN upgrade Debian jobs to enhance coverage.

Closes-Bug: #2035584

Change-Id: I78967c4499269578ac921ad9a553946b65e1293f

When using the 'q35' machine type, by default, it allows only
a single PCIe device to be hotplugged. Nova currently sets
'num_pcie_ports' to "0" (defaults to libvirt's "1"), which is
not sufficient for hotplug use.

The max value is 28, but 16 is enough in most cases.

More info please check

* [0] https://libvirt.org/pci-hotplug.html
* [1] https://marcin.juszkiewicz.com.pl/2018/02/19/hotplug-in-vm-easy-to-say/
* [2] https://review.opendev.org/c/openstack/nova/+/545034



Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com>

Change-Id: I7b8063566837aeb947927b7d6858417982b63deb
Closes-Bug: 1909063

For example, an operator may wish to customise the
nova-compute-ironic service configuration without affecting
other Nova services.

Closes-Bug: #2034949

Change-Id: If8648d8e85ab3dbcbb4ecba674b2e34b06898327

The cafile parameter in the authentication section is required
in the senlin.conf configuration file when working with
self-signed certificates.

Change-Id: I3cd43cc7f43782a6c1d701a3e5b977bbc42e3719

Currently clustering steps are very static, if for a reason first
node in the inventory fails and gets re-introduced - K-A will create
a second empty cluster on that node.

This patch changes the approach and checks if cluster exists, if it
does - chooses a donor for the new node from currently running
node set.

Also it fixes node replacement - it removes old node from cluster
(that has the same ip address as newly provisioned node).

Closes-Bug: #1875223

Change-Id: Ia025283e38ea7c3bd37c7a70d03f6b46c68f4456

Related-Bug: #2015184

Closes-Bug: #2015184

Change-Id: I6ea0949d58e38e2cda41c9702001e7bd500f23f1

Change-Id: Ia982df80d688522dbaa5fc3e462c1a009d512cb6

This commit adds the ironic-prometheus-exporter, following the
conventions used by the previously integrated exporters. '[The] Ironic
Prometheus Exporter is a Tool to expose hardware sensor data in the
Prometheus format through an HTTP endpoint.'[0]

Prometheus has been enabled in CI jobs to ensure test coverage.

[0] https://opendev.org/openstack/ironic-prometheus-exporter

Depends-On: https://review.opendev.org/c/openstack/kolla/+/874415

Change-Id: I6d421effd833d2e0524dd0b81736445c9a730ea9

An OVS-DPDK task had part of its name capitalized,
presumably due to the newly added ansible linter,
but this change was not reflected in the notify
module which calls the task. This results in an
inability to deploy openstack with OVS-DPDK.

This commit fixes the name of the task in the
notify module.

Closes-Bug: #2033413
Change-Id: Iae8a937bb2c35d2eb83e2c4522d829a6cfe25f0d
Signed-off-by: Juan Pablo Suazo <jsuazo@whitestack.com>

Change-Id: Ica155c5da29d36a3f944eb6a4a0ef5af88b01358

It is useful when external network's MTU is lower then internal
geneve networks.
Host kernel needs to be in version >= 5.2 for this option to work.
All Kolla supported host operating systems have higher kernel version.

Change-Id: Id64e99b07e2bb5e6c97b784f4ffedafc7e7de188

Kolla is setting the producer tasks to None, and this
disables all producer tasks.

Starting with the next release of Designate a new task
was added to the producer named increment_serial that
is now critical path for incrementing the serial for each zone.
https://github.com/openstack/designate/commit/fb9c2da977a36afc695b1e75a81aa85d8e56ef0a

Closes-Bug: #1879557
Change-Id: Ief8dca4e27197c9576e215cbd960da75f6fdc20c

Since I033c51704bfb806f6515db26b8159fae12469ba5 the DUMMY_ENVIRONMENT
environment for cron container is useless, lets drop it.

Trivial-Fix

Change-Id: Id8bf642a57b54ecafe0ee6981e044b1aba872ef7
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Sets the variable ``om_enable_rabbitmq_high_availability`` to ``true``
by default. An upgrade will therefore require some manual steps to
migrate from transient to durable queues. Note that this will be
caught by this precheck:
https://review.opendev.org/c/openstack/kolla-ansible/+/880274

Also updates the CI upgrade jobs to perform this migration. This will
need to be removed in Caracal.

Related-Bug: #2031294

Change-Id: I26a70d4722aaa4663eced5f5337840474c7b961c

This command can be invoked with ``kolla-ansible rabbitmq-reset-state``.
This is primarily designed to be used when enabling HA queues[1].

As such, this also updates the RabbitMQ documentation to use this
command.

[1] https://docs.openstack.org/kolla-ansible/latest/reference/message-queues/rabbitmq.html#high-availability

Change-Id: I6ad95a3618fc1a34af56657ef99ef14dc979f17a

Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/892323

Change-Id: I11db700511233aa60229ee65d0cc96e46aafdf90

Change I60162b54bc06e158534d29311d4474b34750c64d
removed the `/v3` prefix from the WEBSSO_KEYSTONE_URL
variable. However, keystone endpoints do in fact
have the `/v3` prefix, and Horizon expects the
WEBSSO_KEYSTONE_URL variable to already contain
the prefix.

This patch adds the prefix again so that SSO
works with Horizon again.

Closes-Bug: #2028921
Change-Id: I5799f7a6fa4f52c2904b14fc02ed18443f4194bd
Signed-off-by: Juan Pablo Suazo <jsuazo@whitestack.com>

Change-Id: I42f9f182a2dab8563008e8b817ac58a69b72b062

Threads are the recommended way to scale CPU performance since HAProxy
1.8.

Official documentation says: « While "nbproc" historically used to be the only
way to use multiple processors, it also involved a number of shortcomings
related to the lack of synchronization between processes (health-checks, peers,
stick-tables, stats, ...) which do not affect threads. As such, any modern
configuration is strongly encouraged to migrate away from "nbproc" to
"nbthread". ».

Change-Id: I6f2e9d74e68703c8e0827e495945a75f020e1561

Since we use "sleep infinity" in kolla_toolbox container - stopping it
always ends up with exit code 143.

Let's use a wrapper script that handles signals correctly.

Closes-Bug: #2031692

Depends-On: https://review.opendev.org/c/openstack/kolla/+/891777
Change-Id: I84295b909d788ceb67bf09ef60fb0583108b111b

MariaDB bootstrap has a phase where the first MariaDB container
is running with Galera bootstrap - after a check that WSREP
is synced is successful - we restart the container.

The bootstrap container is named mariadb and running with
docker_restart_policy: "no" - the restarted container should be running
in systemd.

Before this patch the code created a systemd unit but it was initially
stopped - so stopping was always a success - and the container would be
killed with SIGKILL on removal (which obviously breaks MariaDB).

This patch also improves docker/systemd stops by waiting for real
unit/container stop and adds failing CI for containers that are
killed with signal 9.

Closes-Bug: #2029613

Change-Id: I0a03e509ce228a50e081fcab44d2b4831251190c

This change block access to the public /server-status url on all
http services exposed by HAProxy, also fixes an issue with Horizon
where 'Require all granted' open access to the /server-status in
the HAProxy-less configurations. Without this change the issue
affects only Ubuntu/Debian installations where mod_status in Apache2
enabled by default.

Closes-Bug: #1996913
Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

The directive used has the same semantic as what is done above for nbproc > 1:
it binds each thread to a CPU. It is simpler and does not require a loop because
it uses the auto: syntax available in HAProxy 2.4.

Change-Id: I1ce124b678140f5f4737df557683bb67bc7cfc66

Threads are the recommended way to scale CPU performance since HAProxy
1.8.

Official documentation says: « While "nbproc" historically used to be the only
way to use multiple processors, it also involved a number of shortcomings
related to the lack of synchronization between processes (health-checks, peers,
stick-tables, stats, ...) which do not affect threads. As such, any modern
configuration is strongly encouraged to migrate away from "nbproc" to
"nbthread". ».

While more recent versions of HAProxy automatically detect the number of
available CPU and enable threads for them, it can be useful to explicitely set
the value.

In this patch, setting cpu-map for threads is not supported.

Change-Id: Id917c70f3dbe52f24f25d9403ba8151729e8966b

With the parameter ironic_agent_files_directory it is possible to provide
the directory for the ironic-agent.kernel and ironic-agent.initramfs
files. By default the parameter is set to the value of node_custom_config.
This corresponds to the existing behaviour.

Change-Id: I53bb0eddc5380713a967356c85897d8df8ce505f

The external_protocol variable does not exist, resulting in an error
during the venus deployment process. This commit will fix that.

Closes-Bug: #2029353

Change-Id: I2d983eecd8861689fdab7d60bdb9dd34ea0c159e

With the libvirt driver, during live migration,skip comparing guest CPU
with the destination host. When using QEMU >= 2.9 and libvirt >= 4.4.0,
libvirt will do the correct thing with respect to checking CPU
compatibility on the destination host during live migration.[1]

[1] https://opendev.org/openstack/nova/commit/267a40663cd8d0b94bbc5ebda4ece55a45753b64

Change-Id: I947c94b59368c7a2740583bf57e407296473d75e

Labels are supposed to be strings, but prior to
https://github.com/ansible/ansible/pull/80040

 Ansible
did not enforce this.

Change-Id: Iefad160be12f1b5e689a74a82714857fa867d69a
Signed-off-by: Paul Arthur <paul.arthur@flowerysong.com>

The OpenSearch Dashboards container does not have a health
check defined when created. This causes the container to always
restart when reconfigured, even if no change has been made.

Change-Id: I0b437a77aeb61bc5ae9238f900a1fa00cbc34e18
Partial-Bug: #2028362

Change-Id: I7ea236f59a7ede1f5a9ab4c60e7e5aba907ea5b8