This change enables the use of Docker healthchecks for rabbitmq services.

Implements: blueprint container-health-check
Depends-On: https://review.opendev.org/c/openstack/kolla/+/784562

Change-Id: I23a2c2efab858b9ed39c6ce0ec4a82df10e7f93d

Change-Id: I1010ee42aaf1c650d9e3b5332ebf828646a6badf

Adds HAcluster Ansible role. This role contains High Availability
clustering solution composed of Corosync, Pacemaker and Pacemaker Remote.

HAcluster is added as a helper role for Masakari which requires it for
its host monitoring, allowing to provide HA to instances on a failed
compute host.

Kolla hacluster images merged in [1].

[1] https://review.opendev.org/#/c/668765/



Change-Id: I91e5c1840ace8f567daf462c4eb3ec1f0c503823
Implements: blueprint ansible-pacemaker-support
Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Co-Authored-By: Mark Goddard <mark@stackhpc.com>

Kolla-ansible is currently installing mariadb
cluster on hosts defined in group['mariadb']
and render haproxy configuration for this hosts.

This is not enough if user want to have several
service databases in several mariadb clusters (shards).

Spread service databases to multiple clusters (shards)
is usefull especially for databases with high load
(neutron,nova).

How it works ?

It works exactly same as now, but group reference 'mariadb'
is now used as group where all mariadb clusters (shards)
are located, and mariadb clusters are installed to
dynamic groups created by group_by and host variable
'mariadb_shard_id'.

It also adding special user 'shard_X' which will be used
for creating users and databases, but only if haproxy
is not used as load-balance solution.

This patch will not affect user which has all databases
on same db cluster on hosts in group 'mariadb', host
variable 'mariadb_shard_id' is set to 0 if not defined.

Mariadb's task in loadbalancer.yml (haproxy) is configuring
mariadb default shard hosts as haproxy backends. If mariadb
role is used to install several clusters (shards), only
default one is loadbalanced via haproxy.

Mariadb's backup is working only for default shard (cluster)
when using haproxy as mariadb loadbalancer, if proxysql
is used, all shards are backuped.

After this patch will be merged, there will be way for proxysql
patches which will implement L7 SQL balancing based on
users and schemas.

Example of inventory:

[mariadb]
server1
server2
server3 mariadb_shard_id=1
server4 mariadb_shard_id=1
server5 mariadb_shard_id=2
server6 mariadb_shard_id=3

Extra:
wait_for_loadbalancer is removed instead of modified as its role
is served by check already. The relevant refactor is applied as
well.

Change-Id: I933067f22ecabc03247ea42baf04f19100dffd08
Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com>

* Don't generate masakari.conf for instance monitor
* Don't generate masakari-monitors.conf for API or engine
* Use a consistent name for dimensions -
  masakari_instancemonitor_dimensions
* Fix source code paths in dev mode

Change-Id: I551f93c9bf1ad6712b53c316074ae1df84e4352b

We can't check this with timedatectl as it is not aware
of any "non-native" NTP daemon.

This could be a warning-level message but we don't have
such messages from the prechecks.

Closes-Bug: #1922721
Change-Id: I6db37576118cf5cff4ba7a63e179f0ab37467d22

Per [1].

[1] http://lists.openstack.org/pipermail/openstack-discuss/2021-February/020707.html

Change-Id: Id6f3cd158bf5d01750971249b11364b6a8631789
Closes-Bug: #1885689

After WSGI implementation the permissions were not fixed.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/783845

Change-Id: I908efe29dcd16c10b0bc88582d8dfb23ba573a35

Change-Id: I947c2940518c0f4872acaa977edeaca370dc9a96

host -> host_ip[0]
Remove deprecated configuration notification_topics.

WARNING oslo_config.cfg [-] Deprecated: Option "notification_topics"
from group "DEFAULT" is deprecated. Use option "topics" from
group "oslo_messaging_notifications".

[0]https://docs.openstack.org/cyborg/latest/configuration/sample-config.html

Change-Id: Ia5d53fb60d34c1509c6cdb905cbd0a93dd1c8b3d

Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com>

Depends-On: https://review.opendev.org/c/openstack/kolla/+/782906

Change-Id: I73cd776772a45c9ffcb045f4d0eff8f4bdc997f1

Depends-On: https://review.opendev.org/c/openstack/kolla/+/782815
Change-Id: I5230f017f1fa99629b81d944ba245c5778411b1f

This change also adds support for Octavia backend TLS.

Closes-Bug: #1874228
Depends-On: https://review.opendev.org/c/openstack/kolla/+/779892
Change-Id: I5ff84aec4cdbc15f6a797391815243821dbdbd67

For using 3rd party Octavia providers (such as OVN provider) an
octavia-driver-agent container must be running to expose those providers to
use.

OVN CI job has been extended with deploying Octavia and testing OVN Load
Balancer.

Closes-Bug: #1903506
Depends-On: https://review.opendev.org/c/openstack/kolla/+/771191

Change-Id: Ibafa8b7307981f2a51e630cc113d18af6162171c

Allow users to import custom grafana dashboards.
Dashboards as JSON files should be placed into
"{{ node_custom_config }}/grafana/dashboards/" folder.

Change-Id: Id0f83b8d08541b3b74649f097b10c9450201b426

ELK 7 requires some minor changes from the existing ELK 6 config.

Depends-On: Icfa3db5788b25f70ee75411dbaf20d8d4a6a734b
Change-Id: I9815d202a77da0477aea43d714a5def8a24724fa

The rabbitmq_prometheus plugin is available in RabbitMQ 3.8.

https://www.rabbitmq.com/prometheus.html



Implements: blueprint rabbitmq-prometheus
Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Change-Id: I4d69a93a6c70db8d40626042cdbe773747b238ae

This trivial patch is just turning off ansible
changed report for group_by tasks as it could
be confusing for user.

Change-Id: I7512af573782359a6f01290a55291ac7eb0de867

This change enables the use of Docker healthchecks for haproxy services.
Implements: blueprint container-health-check

Change-Id: I4b486e9c78e9a01a0f5983b83aca00ea3a001dcc

In I165199fc98fb98f227f2a20284e1bab03ef65b5b and
Ic745300b27e50132d80d03787fa4abfada2d0173 we provided flags to disable
Docker's control of iptables and bridge networking respectively. The
original behaviour was maintained for backwards compatibility, to allow
the patches to be backported.

This patch changes the default behaviour to disable the manipulation of
iptables and disabling bridge networking.

Related-Bug: #1849275
Related-Bug: #1848249

Change-Id: I4e8206f13a847ff79e06c36d22068597458b6c3d

Docker is using 172.17.0.0/16 by default for bridge networking on
docker0, and this might cause routing problems for operator networks.

This change introduces docker_disable_default_network to disable the
bridge networking by putting "bridge: none"[1] to daemon.json

Bridge networking does not work without iptables, so we set the default
for docker_disable_default_network to
docker_disable_default_iptables_rules.

For better defaults, this feature will be enabled by default in
Wallaby.

[1] https://docs.docker.com/engine/reference/commandline/dockerd/

Change-Id: Ic745300b27e50132d80d03787fa4abfada2d0173
Closes-Bug: #1848249
Related-Bug: #1849275

This change enables the use of Docker healthchecks for elasticsearch services.
Implements: blueprint container-health-check

Change-Id: Ib50d56cc206a80b20a4f96e95bcdd8d11269234f

This change enables the use of Docker healthchecks for kibana services.
Implements: blueprint container-health-check

Change-Id: If7525e193c245435410b4071aed6d3b566424219

In order to disable libvirt debug in CI (which takes vast amount of storage)
this change introduces nova_libvirt_logging_debug and disables that in CI.

Change-Id: I90bfd1b300ad3202ea4d139fda6d6beb44c5820f

According the documentation [1] there need to configure auth_uri in the
[filter:s3token] section instead of www_authenticate_uri which cause an
error 'swift.common.wsgi.ConfigFileError: Invalid auth_uri; must
include scheme and host' during start the swift-proxy-server container.

1. https://docs.openstack.org/swift/ussuri/middleware.html#s3-token-middleware



Change-Id: I6b8f5807ebb746428a501dca13eae30763dede8d
Closes-Bug: 1862765
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Cinder api v2 support removed in  wallaby.
refer to http://lists.openstack.org/pipermail/openstack-discuss/2020-November/018697.html

Change-Id: I120101d6c30f9169f4c3811357b5ed06496c90ff

use User and Group in octavia-interface service.
this way looks more graceful

this change also fix the octavia-interface does not restart
when the octavia-interface.service changed.

Change-Id: I9d253d7519b1774985d165a080047fdbecd321b4

This change enables the use of Docker healthchecks for vitrage services.
Implements: blueprint container-health-check

Change-Id: Icd2a8471a08b737352cfe941b5d38b02ed3b19fe

This change enables the use of Docker healthchecks for aodh services.
Implements: blueprint container-health-check

Change-Id: Ic477ac77f7ea5c50de473382fb1ec63d78043267

This change enables the use of Docker healthchecks for gnocchi services.
Implements: blueprint container-health-check

Change-Id: Ib1eb766d061c376c0bdd693dd6ea1e5b3e3fc02a

This change enables the use of Docker healthchecks for ironic services.
Implements: blueprint container-health-check

Change-Id: If0a11db5470899c3a0e69ca94fdd0903daadcf8b

This change enables the use of Docker healthchecks for designate services.
Implements: blueprint container-health-check

Change-Id: Ide66a914b790ad9c106ba932a923654a960f7abf

Min version stays as 2.9

Change-Id: I7ec8c5eb36757248c9aa016dc7d4e495ec5bb635

Change-Id: I0f107d8239ae0cbef3bb4569ec5d77326f8974fc

Change-Id: Ief84e093829677c97c8df9a08aefca43b1e51aac

The merge_configs action plugin is updated with an option to control
whether whitespace should be used around equal signs. The default
remains to use whitespace: only zookeeper.cfg doesn't use them.

This is to avoid issues with the zkCleanup.sh script which expects no
whitespace. The ZooKeeper documentation also uses no whitespace in
configuration file examples.

Change-Id: Ia082a1c002cc4e8b04f7696fdee827b747c6d13f
Closes-Bug: #1917490

In services which use the Apache HTTP server to service HTTP requests,
there exists a TimeOut directive [1] which defaults to 60 seconds. APIs
which come under heavy load, such as Cinder, can sometimes exceed this
which results in a HTTP 504 Gateway timeout, or similar. However, the
request can still be serviced without error. For example, if Nova calls
the Cinder API to detach a volume, and this operation takes longer
than the shortest of the two timeouts, Nova will emit a stack trace
with a 504 Gateway timeout. At some time later, the request to detach
the volume will succeed. The Nova and Cinder DBs then become
out-of-sync with each other, and frequently DB surgery is required.

Although strictly this category of bugs should be fixed in OpenStack
services, it is not realistic to expect this to happen in the short
term. Therefore, this change makes it easier to set the Apache HTTP
timeout via a new variable.

An example of a related bug is here:

https://bugs.launchpad.net/nova/+bug/1888665

Whilst this timeout can currently be set by overriding the WSGI
config for individual services, this change makes it much easier.

Change-Id: Ie452516655cbd40d63bdad3635fd66693e40ce34
Closes-Bug: #1917648

This change allows a user to forward control plane logs
directly to Elasticsearch from Fluentd, rather than via
the Monasca Log API when Monasca is enabled. The Monasca
Log API can continue to handle tenant logs.

For many use cases this is simpler, reduces resource
consumption and helps to decouple control plane logging
services from tenant logging services.

It may not always be desired, so is optional and off by
default.

Change-Id: I195e8e4b73ca8f573737355908eb30a3ef13b0d6

The Monasca alerting pipeline provides multi-tenancy alerts and
notifications. It runs as an Apache Storm topology and generally
places a significant memory and CPU burden on monitoring hosts,
particularly when there are lot of metrics. This is fine if the
alerting service is in use, but sometimes it is not. For example
you may use Prometheus for monitoring the control plane, and
wish to offer tenants a monitoring service via Monasca without
alerting and notification functionality. In this case it makes
sense to disable this part of the Monasca pipeline and this patch
adds support for that.

If the service is ever re-enabled, all alerts and notifications
should spawn back automatically since they are persisted in the
central mysql database cluster.

Change-Id: I84aa04125c621712f805f41c8efbc92c8e156db9

The Log Metrics service is an admin only service. We now have
support in Fluentd via the Prometheus plugin to create metrics
from logs. These metrics can be scraped into Monasca or Prometheus.
It therefore makes sense to deprecate this service, starting by
disabling it by default, and then removing it in the Xena release.
This should improve the stability of the Monasca metrics pipeline
by ensuring that all metrics pass via the Monasca API for
validation, and ensure that metrics generated from logs are
available to both Prometheus and Monasca users by default.

Change-Id: I704feb4434c1eece3eb00c19dc5f934fd4bc27b4