For possible config options see docs
https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html#memcache-protection



Closes-bug: #1850733
Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
Change-Id: I169e27899f7350f5eb8adb1f81a062c51e6cbdfc

OpenvSwitch container needs to be restarted for hw offload to be
enabled/disabled properly [1].

OpenvSwitch container will also be restarted when system-id or
hostname changes.

Closes-Bug: #2076335

[1] https://docs.openstack.org/neutron/2024.1/admin/config-ovs-offload.html#configure-open-vswitch-hardware-offloading

Change-Id: I444fc345e5d21ed969f48aa9a6230905cc411149

Change I60162b54bc06e158534d29311d4474b34750c64d
removed the '/v3' suffix from horizon_keystone_url variable,
but the version is needed for some operations.
This patch fixes the "Change password" Horizon function
until Horizon bug #2073639 is resolved.

Closes-Bug: #2073159
Change-Id: I6ff46b47e9109d0757f2e5ce8019ba591b9892e1

A host that is in the manila-share group, but not in controllers
network, etc., will fail service deployment if it is not using the
generic manila driver (eg, if it is using the CephFS native driver).
This is because deployment of openvswitch-vswitchd is predicated on
the drivers enabled for manila-share.  However, this predicate is not
universally applied.  Where inventory group membership is used the
dependency on openvswitch-vswitchd presence will fail.

Closes-Bug: #1993285

Change-Id: I821e513d24f2a1c59240d65ad68c3b5f2080e439

Also stop using the old config name (td-agent.conf)

Change-Id: Ied2736b891cd8c6dfcc509a8fd6b1fc8bfe21cb4

This fixes an issue where it is not possible to customise the `host`
config option in the Nova Compute Ironic config file without breaking
detection of the service.

This is a backwards compatible fix, which allows a user to set the
`host` config option using Ansible host or group vars.

Other reasons for not using the default host setting of
`{{ ansible_hostname }}-ironic` are covered in [1].

[1] https://specs.openstack.org/openstack/nova-specs/specs/2024.1/approved/ironic-shards.html#migrate-from-peer-list-to-shard-key.

Closes-Bug: #2056571
Change-Id: I9b562f6a5722f21b7dbec2a4d53a46a57c829155

This patch modifies tasks that are delegated to
localhost to use local connection.
Firstly, this is correct since SSH connection is not used,
and secondly, it fixes the issue when kolla-ansible is
packaged in a docker container. If the local connection
is not used, the tasks will fail because temporary data are
stored outside the container, whereas we need it to be
stored inside the container so we can read them and set_facts.

Closes-Bug: #2073370
Change-Id: I9547d5da78da30bfeea8e97056cfa9308c977098

Fixes an deploy opensearch whith enable TLS on the internal VIP

Closes-Bug: #2073224
Change-Id: I50ce48c4e3c645e2f3aeee4913a9bc9ee506040a

Closes-Bug: #2070051

Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/923544

Change-Id: I221eb136e77c61aef39e8646b48b927352d1419d

Barbican switched to oslo.db as per [1]
This patch is fixing kolla-ansible config
for barbican.

[1] https://review.opendev.org/c/openstack/barbican/+/848011

Closes-Bug: #2072554
Change-Id: Idc7bcd1aa2cbb9a08facb3140eed0f22d5d7e99f

There was a bug where setting the test command
for the health check to 'NONE' would throw an error
in podman_worker. This was problematic since K-A
uses 'NONE' as an indicator that the health check is not enabled.

Closes-Bug: #2071912
Change-Id: I3140bb79eace58b23f579be3da569c502c52c38c
Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com>

Change-Id: I3023f88f710ff6b41c95d570c571af8ef009efe8

ansible-core 2.16 and later requires python 3.10+ (see [1])

[1]: https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix

Change-Id: Id5e10872de413e7b476c5343360d73c109b9667a

Add more explanatory documentation why is parsing of
volumes needed during creation of container to stay
consistent with the documentation inside docker worker.

Change-Id: Id7c90a6ec04f4a21a75f2edb39f80a64199b5f86
Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com>

Currently, service-cert-copy role used to copy certs and CA
into containers has 'when' statements  that check if HAProxy is
defined and enabled for the service. However, some services like
RabbitMQ, ProxySQL or Redis don't use HAProxy

This patch removes the when condition, as it is not necessary.

PartiallyImplements: mariadb-ssl
Change-Id: I8864e05212e0ed76ea3a0108b00ed9dd04b1a697

Most roles are not leveraging the jinja filters available.
According to [1] filtering the list of services makes the execution
faster than skipping the tasks.

This patchset also includes some cosmetic changes to genconfig.
Individual services are now also using a jinja filter. This has
no impact on performance, just makes the tasks look cleaner.

Naming of some vars in genconfig was changed to "service" to make
the tasks more uniform as some were previously using
the service name and some were using "service".

Three metrics from the deployment were taken and those were
- overall deployment time [s]
- time spent on the specific role [s]
- CPU usage (measured with perf) [-]
Overall genconfig time went down on avg. from 209s to 195s
Time spent on the loadbalancer role went down on avg. from 27s to 23s
Time spent on the neutron role went down on avg from 102s to 95s
Time spent on the nova-cell role went down on avg. from 54s to 52s
Also the average CPUs utilized reported by perf went down
from 3.31 to 3.15.
For details of how this was measured see the comments in gerrit.

[1] - https://github.com/stackhpc/ansible-scaling/blob/master/doc/skip.md



Change-Id: Ib0f00aadb6c7022de6e8b455ac4b9b8cd6be5b1b
Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>

Change-Id: I96151bb6809a4bf0f17dd3e0e97a654730881869

This enables you to scrape external targets more easily.

Change-Id: I55b612d2f5f5a3fc8d21c6d2f71d6c58d89d4e31

When using short notations like `1g` or `512m` to define the
container dimensions, we are always getting the container to
being restarted in each kolla-ansible run, even with no real
changes in the container configs.

Change-Id: Ic8e2dd42b95a8f5c2141a820c55642a3ed7beabd
Closes-Bug: #2070494

Fix kolla systemd unit template to prevent restart
all kolla services with docker.service restart

Change-Id: I70dd1751dea6bfc9bb265aeda04b3392e135324c
Closes-Bug: 2065168

Change the skyline nginx config to point to the internal port.

Closes-Bug: #2069855
Change-Id: Ia29d89b2594a604c687469850a67f7fe29d0eb5d

Moves the execution of Nova roles after Open vSwitch roles.
Current order of execution causes VMs to not be able to start after the redeployment of Openstack during container engine migration.

Change-Id: I8ad0dcdfaf419dfbc04d19203424adecd400db05
Signed-off-by: Martin Hiner <martin.hiner@tietoevry.com>

If rabbitmq is not on the same host as the nova-controller,
then this task will fail. This change ensures that the
task references an actual rabbitmq host vs the host the
task runs on.

Closes-Bug: 2020805
Change-Id: I1b58f4aeda8c9fe8db1770c63c17bf1c465f3d2a

List of strings CONTAINER_PARAMS is missing comma separators,
which makes it an implicit concatenation of list items
that should be separate.

Closes-Bug: #2067278
Change-Id: Iec9a8de184481dae058377fa8d7bbd8da729d62c
Signed-off-by: Martin Hiner <martin.hiner@tietoevry.com>

If the container image used by Mariabackup is different than the
one used by MariaDB server, it's possible that mariabackup and mariadb
are incompatible. This may cause backup operations to fail.

This change queries the running MariaDB server container's image and
uses it when taking a backup. If MariaDB server isn't running on the
host it falls back to the image defined in configuration.

The separate mariabackup_image, mariabackup_tag and
mariabackup_image_full variables are no longer required and have been
removed.

Closes-Bug: #2058644
Change-Id: I45f3f90ec1973dae92131ea16a7b248ab7a8ae69

Also rename task to "Copying over custom pipeline.yaml file" for
clarity.

Change-Id: I04e3eb9620830a15781f9bab2549b557a9d1d9cb

Depends-On: https://review.opendev.org/c/openstack/cloudkitty/+/880739
Change-Id: Ib8d7182cc4b8a0c7d320ba2c51b2157782030317

Update Sykline stop task to use the
service-stop role to symplify the task
and make sure it is using kolla_container.

Authored-By: Roman Krček <roman.krcek@tietoevry.com>
Change-Id: I7b11359cee931273a058364160b64fe1fb606b5e

This will fix exit codes - details in bug.

Basically openvswitch treats TERM as something fatal (exits
with 143) and the only solution for graceful exit is using
ovs-appctl and sending exit command, just like ovs-ctl utility
does.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/905189

Partial-Bug: #2048130
Change-Id: I523018cb98944de60d7b95404deb7cebd641f33a

Depends-On: https://review.opendev.org/c/openstack/kolla/+/904981

Partial-Bug: #2048130
Change-Id: Ib971b694c12ccb51e0893978dd5962040f2fbd22

-f configdir has been supported in HaProxy since 1.7

Partial-Bug: #2048130
Change-Id: Icb95cb072cb3eb5c27ffd79a127069bfcf21a61a

Configure cloudkitty_influxdb_use_ssl automatically based on the value
of kolla_enable_tls_internal. Set cloudkitty_elasticsearch_cafile,
cloudkitty_influxdb_cafile and cloudkitty_prometheus_cafile to
openstack_cacert.

Disable certificate validation when bootstrapping the InfluxDB database:
the influxdb_database module and the InfluxDB 1.x Python client don't
support specifying a CA certificate file.

This fixes bootstrap and execution of CloudKitty with internal TLS.

Closes-Bug: #1998831
Change-Id: I5524169b9567819d379726099bf70c692c85acc1

Also enable these after an upgrade.

Partial-Bug: #2058512
Change-Id: Ib9bdae2e25c2b6cce30e4c8024015ab5875bc1ff

After Neutron policy changes - Octavia jobs started
to fail on cascade LB deletion due to Neutron user
not having service role.

Closes-Bug: #2065337

Change-Id: I616bf3a3dbb4d963665b1621a9e5e9d417b13942

neutron-fwaas has become active again

Depends-On: https://review.opendev.org/c/openstack/kolla/+/914855

Change-Id: Ie5a7b2da9a351e8f47a1ae830bb2fee0a8e35e38

Closes-Bug: 2063896
Change-Id: Ie0d6a8f458562eb32171b5fe23b8cd0cd375dcfb

It was deprecated in Antelope cycle.

Change-Id: I499e69ec6db63e4067e49376e2a1f3e01e48fe62

It's inactive and hasn't produced a 2024.1 release [1].
In addition to that, there's a CVE that hasn't really been patched [2].

Also drop outward_rabbitmq that was used only with Murano.

[1]: https://governance.openstack.org/tc/reference/emerging-technology-and-inactive-projects.html#current-inactive-projects
[2]: https://lists.openstack.org/archives/list/openstack-announce@lists.openstack.org/thread/4FYM6GSIM5WZSJQIG4TT5Q3UBKQIHLWX/

Change-Id: I691205730b0e10a42ce61f3340cc39ee51bd1010

It's inactive and hasn't produced a 2024.1 release [1].

[1]: https://governance.openstack.org/tc/reference/emerging-technology-and-inactive-projects.html#current-inactive-projects

Change-Id: I217b3633f07e5b2c657e20b19aaa4fbb46535a97

It's inactive and hasn't produced a 2024.1 release [1].

[1]: https://governance.openstack.org/tc/reference/emerging-technology-and-inactive-projects.html#current-inactive-projects

Change-Id: I888963751b6e1ed080588297c2889e700431516c