Change-Id: I8c340cfe33789badb4f8df93f0c13f56fdea5dbf

Make data source creation more dynamic to support a variable number of data
source of different types

Only create data sources actually deployed by kolla

Change-Id: I26a2d3c71b178562b906623ab77eaff673c81dce

The Ironic templates and roles assume Keystone is enabled and they don't
make use of the `enable_keystone var. This patch changes the behavior so
that `noauth` is used as auth method for Ironic if keystone is not
enabled, the Ironic endpoint is not registered if keystone is not
enabled and the keystone section is not created in the config file.

Change-Id: I813de42d10ac264eec81076cb107b58af09ff686

Neutron-sfc-agent start its functions with openvswitch.
This change moves sfc configuration into neutron-openvswitch-agent.

Rework config files to use openvswitch when sfc or openvswitch
are used as network plugin.

Also adds sfc extension_driver to ml2

Change-Id: If1ebf9554f6d686cc6d064e698a48f8a6b6172b3
Closes-Bug: #1664493
Depends-On: I60ba1333231a4ae38a041d41e551f7d74fe15e3b

Ironic inspector should honour the Ansible inventory group
ironic-inspector. Ironic inspector may not be required at all. If
Ironic inspector is required then it should only run on a single
node, and this should be reflected by the inventory.

This change makes a number of Ironic inspector-related tasks dependent
upon the host's membership of the ironic-inspector group. Also, we
couple the ironic-dnsmasq container with the ironic-inspector group
rather than ironic-conductor, as the service is for inspector rather
than Ironic.

Change-Id: Ifd90753b0fe1a55c11b7723c28e1d14ab3d32737
Closes-Bug: #1665257

Trace method is enabled in default for httpd. There is security risk
with trace enabled. So disable it in default. more info please check[0].

[0] https://security.stackexchange.com/a/7711

Change-Id: I4496a6d058d88e1abfb210085f189e7a610e0362
Closes-Bug: #1705160

This reverts commit 898155df.

The default value of the ironic configuration option default_boot_option
will eventually change from netboot to local. The netboot option is
incompatible with multitenancy in ironic, as it requires a PXE
environment in the tenant network, so it was no longer deemed a suitable
default value.

Ironic added a warning message when this option is not explicitly set,
presumably to alert operators to the change. The commit being reverted
set the option to 'netboot'. This will cause operators to continue to
use the netboot option even after the default value changes, which was
presumably not the intention of the ironic team in changing the default
value. It also hides the warning message from the operator that could
alert them to the fact that this default is changing.

Change-Id: I0ebb1d5ffbead50b034488337e6c93a2f48aaf69
Related-Bug: #1696636

kolla-kubernetes is using its own configuration generation[0], so it is
time for kolla-ansible to remove the related code to simplify the
logical.

[0] https://github.com/openstack/kolla-kubernetes/tree/master/ansible

Change-Id: I7bb0b7fe3b8eea906613e936d5e9d19f4f2e80bb
Implements: blueprint clean-k8s-config

Closes-Bug: #1704915
Change-Id: If85cd7bc8547494900c8f6c32dfd1c1f2179f928

Neutron-lbaas-agent container is not restart when neutron_lbaas.conf changed.

Closes-Bug: #1704900

Change-Id: Ie9babdf5ad0875b604cb1728a116b450e0f89858

* remove ceilometer-api and ceilometer-collector service
* use ceilometer-notification to publish message to proper backend
* remove useless ceilometer_database_type and ceilometer_event_type
  variables
* sync event_definitions.yaml, event_pipeline.yaml and pipeline.yaml
  file with upstream

Change-Id: Ib39053cb5f70bd11ee61d3f26d5b28accecd7190

* use gnocchi-api script for wsgi based on this commit[0].
* logfile is deprecated. Use log-file instead[1].

[0] https://github.com/gnocchixyz/gnocchi/commit/c8717e8b71f044953aec744f44f97abad1a0c08e
[1] https://github.com/gnocchixyz/gnocchi/blob/master/gnocchi/opts.py#L77,L82

Change-Id: I8fbe8425e43d82e0f9601ba6303dd7f24142a2e6

cinder_backup_ceph is true in default when enable_ceph is true.

Change-Id: Ic3cbd041a784610323cda4419acb6702f2aa35c1
Closes-Bug: #1699658

This enable cluster_user_trust customization which is needed to get
Kubernetes integration with Cinder and Neutron LBaaS.

https://github.com/openstack/magnum/blob/master/releasenotes/notes/CVE-2016-7404-f53e62a4a40e4d30.yaml#L5

Change-Id: Ib3243b110d2c592f3bf6467b086738335799c853

Add VMware VMDK driver supports to cinder service.
The VMware driver for OpenStack Block Storage is recommended and
should be used for managing volumes based on vSphere data stores.
see
https://docs.openstack.org/ocata/config-reference/compute/hypervisor-vmware.html
https://docs.openstack.org/ocata/config-reference/block-storage/drivers/vmware-vmdk-driver.html#block-storage-vmdk-driver

Partially-implements: blueprint kolla-ansible-support-vsphere

Change-Id: Ic3eb7ae34c1e8584945b3d97f8b427ee67ea8fba

Includes murano-dashboard plugin

Change-Id: If99b0310dac75776ca462034926dd57794572ce9

Base on nova release note[0], all general scheduler configuration
options have been added to the [scheduler] group.

[0] https://github.com/openstack/nova/blob/master/releasenotes/notes/add-scheduler-config-to-scheduler-group-c83bc770e67ac115.yaml

Change-Id: Ic15ecaced3c78b86d04572fbaf2f6be5640a2a25
Closes-Bug: #1680307

Either api_v1 or api_v2 must be True in [image-feature-enabled]

Change-Id: I8d25d4b43b030c58e9c365937d81c82418a47436
Closes-bug: #1703722

Change-Id: Ia92ea9114ffec1dc3108969cb48a3264a23e0eea
Closes-bug: #1703515

designate-api service is launched using dns_interface instead of api_interface.
Haproxy is using the good interface (api_interface), hence designate_api
can't be accessed.

Change-Id: I24e356c167c931a6b69a283efba12117fcff936a
Closes-Bug: #1703425

Ironic resources can be indexed by Searchlight.
This patch enable it.

Change-Id: I003a10055629189791adbb522344e6c9cec597f3

* nova_server resources resources are not actually
indexed.

* nova flavor are not indexed too, cause the notifications topic for
flavors is versioned_notifications.
We need to config notifications_topics_exchanges with value
'versioned_notifications,nova' in order to get the related versioned.

Change-Id: Ibf4ee7d7efceee5aefac5f83e22b994ae33ce047
Closes-Bug: #1703435

* "bool" filter is removed when not required
* 'not' is used instead of '== False' check

Change-Id: I85a5bb9a5ea874ac1c397cbf8de416147d2424c3

The pypi package 'docker-py' [1] has been renamed to 'docker' [2].
It is better to move to the new 'docker' package because the old
package will be deprecated and all the new features will go into
the new package only.

Package 'docker' has been added to requirements [3]. The old
package 'docker-py' is still allowed to be in the global requirements
during the transition period but it should be removed after all or
most of the projects finsih the migration.

[1] https://pypi.python.org/pypi/docker-py
[2] https://pypi.python.org/pypi/docker
[3] https://review.openstack.org/#/c/423715/

Change-Id: Ibcd5a57a1fbf55dcc5a690e41f20917f95b63da0

In ansible 2.3.1, conditional statement should not include jinja2
templating delimiters (e.g. {{ ).  So, this change removes the
delimiters from when statemant, and also removes unnesessary
parentheses from until statement.

Closes-Bug: 1702607

Change-Id: I071ffd5ba6175ee1bc61719a84b805c022753459

Change-Id: I7f1bc7fe0ee2c788c3141ea5353e1348196219e1
Depends-On: Ic0431b10d723bf84eeefc72039376fe0058dd902

User can use custom directory to store images.
For example using a shared file system as backend.

Change-Id: Iab7a9a51e619bdbf8f7bd4626ebe4d703e6d4819

The current module 'kolla_sanity' was written as a shim before full
shade support was added to Ansible. This should now no longer be needed,
we can implement the checks using Ansible provided modules.

Change-Id: If212243e42615d7725201ee577bec40a1305887d
Depends-On: I6e3f4b72243da1cfa76d32822ec4f75f689f7317
Partially-implements: blueprint sanity-check-container

According to [1], Ansible variable names should not include hyphens.
Kolla-Ansible fails with a wrong variable name 'barbican-api' when
deploying Barbican.

This patch fixes the issue that was recently introduced in [2].

[1] http://docs.ansible.com/ansible/playbooks_variables.html#id15
[2] 08ab3d8e

Change-Id: Ib962e31ad93316e56130c9fc38dabfc918de17ce
Closes-Bug: #1703287

Ceph rgw can be used as object store instead of Swift.
This patch enable trove to use ceph rgw as object store.

Change-Id: I50b878078b7c62c1034a102d064dfa90a1357ee8

If use /run/netns, it may cause namepace stale and unable to remove. The
root cause may be that docker engine still unrelease the namespace
folder.

Change-Id: If120d54c266878990c952b60043b596b0a0788ab
Closes-Bug: #1703077

Change-Id: I32de4c37f531a3d22bf80e1eca6635631e489842
Closes-Bug: #1702842

fwaas is in pending create state when I attach it to a router.
This patch fix this.

Change-Id: I18b56ed3698e22a02a8718b39360fde76c12428b
Closes-Bug: #1689703

As described here:
https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L841
https://github.com/openstack/keystone/blob/master/keystone/conf/identity.py#L21

* default project domain name MUST be named 'Default'
* default project domain id MUST be named 'default'
* default project user name MUST be named 'Default'
* default project user id MUST be named 'default'

Change-Id: I610a0416647fdea31bb04889364da5395d8c8d74

Cinder ubuntu binary was already migrated under apache.
This change migrates rest of the distros/install types to
be executed under an apache process.

Change-Id: I8544eec5bfebf771d758f13abf4dfbc802f5d24f

This change [0] reverted designate dashboard change because
designate was not finished, we forgot to enable again.

[0] https://review.openstack.org/#/c/408714/

Change-Id: Ibaf7e5a5dc8cbef619d86a0f2b240d384984e8bd

Custom file was check on remote target instead of local.

Change-Id: I9426056e7bb284eb8b3ad539d61ecb1e1f6370e4
Closes-Bug: #1702490

* fix wrong variable usage for horizon copy policy task
* notify restart keystone container when policy is changed

Change-Id: I3545205d5d3cfcf7bf893187ca6e65bbc152bf33
Closes-Bug: #1702486

In order to speed up deployment time some "local" actions should be run
only once using 'run_once: True'.
This will decrease deployment time in case of multihost configuration.

Change-Id: I6015d772d35c15e96c52f577013b6e41197cb41a

Kolla-ansible actually bring it's own barbican-api-paste.ini file to
enable Keystone authentication, in order to fix this
https://bugs.launchpad.net/kolla/+bug/1625337

auth_token middleware is actually managed by Barbican.

Furthermore barbican-api-paste.ini brings by Kolla-ansible is outdated:
* http_proxy_to_wsgi middleware is missing

Hence this file should not be managed statically by kolla-ansible.
This patch keep custom paste file feature. Just put the file to
/etc/kolla/config/barbican/barbican-api.ini path.

Change-Id: Ia50237f7df7f89526a976575b017145c71b11ec0
Closes-bug: #1695026