Add the new murano_auth section to the Murano config
file so that Murano will deploy application packages.

Change-Id: I8ea7264759742e7af038b4cec346fc7ef7f7edcb

Disable ServerSignature and Hide apache related infromation.

Change-Id: I9188ddb85988539087c922117bb9f53454b7507c

Add become to only neccesary tasks in roles:

- blazar
- opendaylight
- redis
- tempest
- vitrage

Change-Id: Ib3a48c1c21a19a23e87d2e465fd7012e3eee7565
Partial-Implements: blueprint ansible-specific-task-become

Missing [murano_auth] with auth_uri ending in '/v3' leads to
keystone authentication failures - murano uses old v2 keystone.

Change-Id: I41846ac4fa78da90e02d91e8d1cec7405178f7df
Closes-Bug: #1753480

Add become to only neccesary tasks in roles:

- aodh
- barbican
- bifrost
- ceilometer
- ceph
- chrony
- cinder
- cloudkitty
- collectd
- congress
- designate
- elasticsearch
- etcd
- freezer
- gnocchi
- grafana
- influxdb
- ironic
- iscsi
- karbor
- kibana
- kuryr
- magnum
- manila
- mistral
- mongodb
- multipathd
- murano
- octavia
- panko
- qdrouterd
- rally
- sahara
- searchlight
- senlin
- skydive
- solum
- swift
- swift
- tacker
- telegraf
- tempest
- trove
- vmtp
- watcher
- zun

Change-Id: I6e32d94d4172dd96d09d8609e8a5221ab5586a31
Partial-Implements: blueprint ansible-specific-task-become

Skydive need to use internal endpoint
for join keystone like other service.

Change-Id: I6fd76a035ab316f21d483a28a25bfb94c9ed6b95
Closes-Bug: #1747401

Remove duplicated [oslo_policy] in magnum.conf.

Change-Id: I69c82e31d7041d7e8f9c31ba1bf54f0906f2a6dc
Closes-Bug: #1754593

Change-Id: Iad449b35c1e947a0187c5cbf8348d6e9e1b3d597
Closes-bug: #1751976

This ensures that the default value of openstack_release - "auto" - is
handled correctly when deploying bifrost.

Change-Id: I71e6fc5a6b82dc5d6788bf093cd079c45d890ffd

Ansible provide script module to run shell script, The local script at
path will be transferred to the remote node and then executed, so no
need to copy script to remote node and use shell moulde to run it.
this patch optimise it.

Change-Id: If774502b66652f25593cda137cc8a5baefbd9695

Change-Id: Ice5b058fe17ad7d648f21d1ddacaa339c6f7102f

Bifrost uses the www-data user for nginx on debian/ubuntu, and nginx on
other platforms. Kolla-ansible currently uses the nginx user for all
platforms when creating a log directory. This change uses the www-data
user on debian/ubuntu when setting ownership of the bifrost nginx log
directory.

Change-Id: I142a158b6f2e8f8a46b684267f6fbb2a6e22a259
Closes-Bug: #1753750

Kolla add multiple url in one outputs.influxdb.
This configuration is when influxdb is in cluster mode.
We need to write one conf by influxdb server.

Change-Id: I1c788b3c8400e74d50cace5a334311408989c5e1

Bifrost cannot modify /etc/hosts from within a container, so add a
host entry during bootstrap.

This was previously fixed by Ied378b4dd755788e75ad1814cecb5700732ba83e
but the logic in bifrost was changed [1], making it out of sync with
kolla-ansible, and triggering a write to /etc/hosts. This change applies
the new logic in bifrost to kolla-ansible, ensuring that the file will
not need to change in the container.

Longer term we should look at ways to make bifrost less eager to modify
/etc/hosts, accepting any file that will work for RabbitMQ.

[1]
https://github.com/openstack/bifrost/commit/60b9a9917e987e321b97b0f611fc2c77813be8b0

Change-Id: I0ee05feae3630435b2ec52cfeddf33647a974ee0
Closes-Bug: #1661009

Bifrost will determine the name of the service for MySQL based on the OS
distro if mysql_service_name is not set. Setting it explicitly in
extra-vars was causing problems on systems that use mariadb.

Change-Id: I892b1c9cf636b9dfc1bacc92e1e2f0d066018260
Closes-Bug: #1753522

When bootstrap compute hosts for XenAPI, it will generate a facts
file for each compute node. It contains some XenAPI specific variables
for both the compute host and the XenServer where the compute host
run on. This commit is to fetch the facts file into deployment host
and put it under a centralized directory - each compute host will
have a separate sub-dir which is named with its *inventory_hostname*.

In this way, the following tasks can use proper variable from the
proper facts file which exactly belongs to the host they running on.

Change-Id: I68d1a2d098d38c8e6bf4db76cdaf1f0465831822
blueprint: xenserver-support

CVE-2018-1000115

Change-Id: I30acb41f1209c0d07eb58f4feec91bc53146dcea
Closes-Bug: #1753425

Change-Id: I31969667ab86f61d38752954cb0e565ad7e41970
Closes-Bug: #1752760

Change-Id: I1f721a3e9ad3d1a937e05f1d0d53c810b9f2ac39

Change-Id: I653e16270aab539edcec6d8622f0a1c06d04b492

The original code assumes that ElasticSearch will be deployed
on the same node as Kibana. This isn't always the case. When
they are not on the same node, Kibana will not be able to
connect to ElasticSearch and deployment will fail on the task:
'kibana : Wait for kibana to register in elasticsearch'.

A second advantage of making this change is that Kibana won't
break if ElasticSearch goes down on the node that it's running on
when there are additional ElasticSearch instances on other nodes.

A disadvantage of this change is that queries from Kibana to
ElasticSearch will no longer be local.

Closes-Bug: 1751817
Change-Id: I02ab2e7b1eb963b33e29c8f649cc9db0d63316f7

use systemd module to reload the docker service, rather than
command

Change-Id: I2e3b2299365701a08de4025d6ad34cb492b33fda
Closes-Bug: #1751690

when Manila use ceph as backend, Manila will pull keyring
from ceph mon node [0], but the site.yml missing it.

[0]: https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/manila/tasks/ceph.yml#L18

Change-Id: If8f0b9f186a27d9a86227cd5e5ce2405bf57749e
Closes-Bug: #1751534

Change-Id: Ifc0f1e356dd6a5c194d00ab20f3122d17c7223cc

Change-Id: I1d24d4a90a6ab4abc6a3b24c0334b380d53e896a

keystone-ssh is required by keystone-fernet. So start keystone-ssh
container before keystone-fernet.

Closes-Bug: #1751224
Change-Id: Ie1c8ae185549acc3dd87a2c5f0356443ea7924a5

freezer use elasticsearch as database storage, and do
not support mariadb for pike release [0][1]. this PS
to remove the useless mariadb setting.

[0]: https://docs.openstack.org/freezer/pike/install/db-install.html
[1]: https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/freezer/templates/freezer-api.conf.j2#L34

Change-Id: I85124a556b809b916e760415a9605c3c6724215c
Closes-Bug: #1750816

The grafana local admin username can be configured by overriding
the admin user field in the grafana.ini file. However, this will
fail when kolla-ansible attempts to configure any enabled
datasources for grafana because the local admin password is
hardcoded to 'admin'. This change allows the grafana local admin
password to be configured via group vars so that the correct
username is used when configuring datasources.

Closes-Bug: #1750408
Change-Id: I0962200894f7a0452da1c249a68f9230b6fab13f

Murano failed to deploy due to outdated options - it tried to
issue v2.0 Keystone requests instead of v3. With new options that
are similar to other projects deployment succeeds.

Change-Id: I1970641e47fa6f94c2c6427ef49b3160d64c33ed
Closes-Bug: #1750373

Change-Id: I67ea2b1a91dfd61341ae2e5bcd82d1cf0597fe9c
Closes-Bug: #1745957

'deployment' hosts don't need api interface. Previous fix checked
if hosts belong global groups like [compute] or [control] which
is not correct because uses can create own groups and the check
won't work there at all. Here the logic is reversed - we blacklist
groups that don't need api_interface.

Change-Id: Ibaa94004016ba41a2ae5700c48522e254c6ee239
Closes-Bug: #1732846

If control hosts have different names of interfaces one can set
api_interface variables per host. Deployment of keystone fails
because rpc_transport_url and notify_transport_url variables
use bare api_interface instead of one from hostvars.

Change-Id: I8bb4aa2953cf4ba63ef6815f2504d35e5aa0a07b
Closes-Bug: #1748473

This change makes it so that if preconfigured database users are used,
the attempt to change the log_bin_trust_function_creators mysql
variable isn't made anymore.

Also updated the upgrade docs

Change-Id: I356313952d435de6d3b5444c0dd8a71f45aee452
Closes-Bug: 1748269

Closes-Bug: #1748347
Change-Id: I9fffc86e7c69ac5edb93c88636e7d49f73544d85

If enable Ceph MDS and RBD services, they are not conflicting
with Swift service.

Fix the check condition to make sure both Ceph and Swift exist.

Closes-Bug: #1747592

Change-Id: Icc6806125ce72992f7dff00c30d591ffb737a0c6
Signed-off-by: Tone.Zhang <tone.zhang@arm.com>

If we use multiple skydive analyzers, we need to add this configuration.
Works with one node.

Change-Id: I9b52bf184e269d314e2af2ac80dc45557e3533af

Ansible recommends to use apt module instead of apt-get.
This patch fixes install.yml and pre-install.yml accordingly.

Change-Id: I3241ce332e7cf522786e78280643440a30a23875
Closes-Bug: #1747436

Ceph mon have a configure about "mon_max_pg_per_osd"
and default value is 300.
When pgs per osd is exceeded, pool creation will be failed.
But kolla-ansible ignoring this, so user may difficult to find
a main reason for the failure.
We need to catch an error when pool creation is failed.

Change-Id: I92493584faad9bc550fdeeb96b827537daafd0b8
Closes-Bug: #1747414

Follow up of https://review.openstack.org/#/c/454752

Change-Id: I20a3677b30ef6133fc3456b0449464a6a88d1581
Closes-Bug: #1747375

1.Fix the invalid value about selinux policy
2.Update description of task about selinux.The permissive mode
need enable selinux.The parameter named "disable_selinux" is not good.
In order to customize selinux modes, we need a new
parameter named "selinux_state".

Closes-Bug: #1749046
Change-Id: I20c084cf2e46cc0de149afbd34c6dcb77a1051f4