Currently there is no way to configure a CA certificate bundle file for
fluentd to Elasticsearch communication. This change adds a new variable,
'fluentd_elasticsearch_cacert' with a default value set to the value of
'openstack_cacert.

Closes-Bug: #1885109

Change-Id: I5bbf55a4dd4ccce9fa2635cee720139c088268e3

more info: https://review.opendev.org/#/c/721733/



Depends-On: I561ead226f714d98c8e06e6027715a64c3a8e47e
Depends-On: I21c9ab9820f78cf76adf11c5f0591c60f76372a8
Change-Id: Ic740d090211ee331b374a6dac69dfde466df7200
Co-Authored-By: jacky06 <zhang.min@99cloud.net>

more info: https://opendev.org/openstack/kolla-ansible/commit/a6c97d7284c7de437ebfc9f8ee289244f29e65d7



Change-Id: I778d472cc7f6ca19852482a3e309d793973d75a6
Co-Authored-By: jacky06 <zhang.min@99cloud.net>

Similarly to other OpenStack services octavia should support
kolla dev mod for debugging.

Change-Id: I81b79dc0a4c5e40a67af7120a4109dfe11098a97

I9b6bf5b6690f4b4b3445e7d15a40e45dd42d2e84 was updated to use the original
config file name during review, but the config file was not renamed
accordingly. The result is that an empty config file is written out.

TrivialFix
Change-Id: I5d0384b38ddb38133e5e11df85d8cf76f4044a64

The double quotation is not necessary for include_tasks, this
ps to cleanup it.

Change-Id: I0701035d185fdf19286cced7fe51fc277511e4c1

Recently a patch [1] was merged to stop adding the octavia user to the
admin project, and remove it on upgrade. However, the octavia
configuration was not updated to use the service project, causing load
balancer creation to fail.

There is also an issue for existing deployments in simply switching to
the service project. While existing load balancers appear to continue to
work, creating new load balancers fails due to the security group
belonging to the admin project. At a minimum, the deployer needs to
create a security group in the service project, and update
'octavia_amp_secgroup_list' to match its ID. Ideally the flavor and
network would also be recreated in the service project, although this
does not seem to impact operation and will result in downtime for
existing Amphorae.

This change adds a new variable, 'octavia_service_auth_project', that
can be used to set the project. The default in Ussuri is 'service',
switching to the new behaviour. For backports of this patch it should be
switched to 'admin' to maintain compatibility.

If a deployer sets 'octavia_service_auth_project' to 'admin', the
octavia user will be assigned the admin role in the admin project, as
was done previously.

Closes-Bug: #1882643
Related-Bug: #1873176

[1] https://review.opendev.org/720243/



Co-Authored-By: Mark Goddard <mark@stackhpc.com>

Change-Id: I1efd0154ebaee69373ae5bccd391ee9c68d09b30

Replaced "kolla_external_fqdn_cacert" and "kolla_internal_fqdn_cacert" with
"kolla_admin_openrc_cacert". OS_CACERT is now set to the value of
"kolla_admin_openrc_cacert" in the generated admin-openrc.sh file.

Change-Id: If195d5402579cee9a14b91f63f5fde84eb84cccf
Partially-Implements: blueprint add-ssl-internal-network
Depends-On: https://review.opendev.org/#/c/731344/

Update the certificate generation task to create a root CA for the
self-signed certificates. The internal and external facing certificates
are then generated using the root CA.

Updated openstack_cacert to use system CA trust store in CI tests
certificate by default.

Change-Id: I6c2adff7d0128146cf086103ff6060b0dcefa37b
Partially-Implements: blueprint add-ssl-internal-network

During an upgrade from Stein to Train, Kolla Ansible fails while running
TASK [cinder : Running Cinder online schema migration]

This is because the `--max_count 10` option is used, which returns 1
while migrations are processed. According to the upgrade documentation,
the command should be rerun while the exit status is 1:
https://docs.openstack.org/cinder/train/upgrade.html

This issue was introduced by a change to the image [1] which fixed a bug
in the way that the max count was interpreted, but exposed an issue in
using the max count.

This change fixes the issue by ceasing to pass MAX_NUMBER, which will
cause all migrations to occur in a single pass.

[1] https://review.opendev.org/#/c/712055

Change-Id: Ia786d037f5484f18294188639c956d4ed5ffbc2a
Closes-Bug: #1880753

more info: https://opendev.org/openstack/kolla-ansible/commit/a6c97d7284c7de437ebfc9f8ee289244f29e65d7



Change-Id: I44850d6bb77fec33aa93e1b523eadfe0ef9483a8
Co-Authored-By: jacky06 <zhang.min@99cloud.net>

The flag -es.uri is no longer accepted - it should be --es.uri.
Similarly with -web.listen-address. The following error is seen:

    elasticsearch_exporter: error: unknown short flag '-e', try --help

This change switches to double dashed long options.

Change-Id: I039f4cad970352146462450742056f5990a81b06
Closes-Bug: #1880242

This patch is removing chrony package
from docker host when containerized chrony is enabled.
It is also fixing issue with chrony container running
under Ubuntu docker host as noted below.

+ exec /usr/sbin/chronyd -d -f /etc/chrony/chrony.conf
2020-06-08T08:19:09Z chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 -DEBUG)
2020-06-08T08:19:09Z Fatal error : Could not open configuration file /etc/chrony/chrony.conf : Permission denied

Added also removal apparmor profile for ubuntu when
containerized chrony is enabled, as chrony's package
is not removing apparmor profile, and therefore
containerized chrony is not working.

Change-Id: Icf3bbae38b9f5630b69d5c8cf6a8bee11786a836
Closes-Bug: #1882513

Grafana changed the error message wording.
Match on the shortest sane string to play it safe.

Change-Id: Ic175ebdb1da6ef66047309ff07bcbba98fc67008
Closes-Bug: #1881890

related to newly introduced merge mechanism.
1) Per-host overrides cannot be run_once.
2) Since merge_yaml is silent about missing files, it ignored
   the fact that no proper file was given due to wrong variable
   being referenced (see the closed bug).

Change-Id: I6db4af4c6e3364838bdae510f300038b0c1560b0
Closes-Bug: #1882460

There's a logic error here, we call nova role from nova.yml file
under ansible folder. we should clone code before run
bootstrap_service task. if not, /opt/stack/nova which is empty
will mount to nova_api container.

Change-Id: Icc54c15080db9c2dc92709480e00b990e5a88662

planned task removal

Change-Id: I613794667b8c08f524a69e7e3f447b2217efb3f7

When installing kolla with external ceph, ceph_cinder_user
var has to be set per documentation instead of ceph_cinder_volume_user.
This value is also rendered in example etc/kolla/globals.yml file.

This patch is fixing this bug or, let's say typo.

Change-Id: Id82b07867f4bc0e5d5e56363f0122014df6892bc

Change-Id: Id43627c6b6d305d0efbdd27ac5a2efbd5bee9107

Provides mechanism to deploy custom skydive.conf files.

Change-Id: I3033b6268a2e955f3e86b1b7000db17c1bb18c47

Since the Victoria released, the unnecessary task should be clean up.

Change-Id: Idd2a05ed0594dcca6fa9881dee63f5550cb6dc0e

Change-Id: Iea3f4f3d2e5c6040c1e0bc7bfae8719cc7d8ac55

Change-Id: I2f618d52b1f1c5a8803d0cd563de391de2d0f223

This was missed in the original patch.

Change-Id: I991b0563560cf4a0b1feb718951ffdf21ab81856

non-root user has no permission to create directory under /opt
directory. use "become: true" to resolve it.

Change-Id: I155efc4b1e0691da0aaf6ef19ca709e9dc2d9168

Fixed on ``Copying VMware vCenter CA file`` and ``Copying over nsx.ini``.

Change-Id: If909f59e7e4b241594c6b2567784ecad23e74226
Closes-Bug: #1882252

Change-Id: I8633f7d250f331ca96788d8f4796889c3c312406
Closes-Bug: #1882259

STATIC_ROOT in local_settings.py should be configured
to path which is also configured in apache's config.

For debian, ubuntu binary setup it is
/var/lib/openstack-dashboard/static.

Reason why it is "accidentaly" working is:

For debian package:
Package is overriding STATIC_ROOT in
/etc/openstack-dashboard/local_settings.d/_0003_debian_static_root.py.
But this is going to be removed from settings in
https://review.opendev.org/733607.

For ubuntu package:
Ubuntu package is adding patch to package which is including
PYTHON_PATH do /usr/share/openstack-dashboard/
And also they are creating several dirty symlinks to get it working.

This patch is fixing this behaviour more clearly.

Change-Id: I9862ac7ab462ca9018b684d63f26458ddda9f73a

backport: ussuri, train

Without this the container returns an empty response.

Change-Id: Ic36845f3fc625c080c92904b58ace070dd24fbb2
Closes-Bug: #1881784

The __future__ module [1] was used in this context to ensure compatibility
between python 2 and python 3.

We previously dropped the support of python 2.7 [2] and now we only support
python 3 so we don't need to continue to use this module and the imports
listed below.

Imports commonly used and their related PEPs:
- `division` is related to PEP 238 [3]
- `print_function` is related to PEP 3105 [4]
- `unicode_literals` is related to PEP 3112 [5]
- `with_statement` is related to PEP 343 [6]
- `absolute_import` is related to PEP 328 [7]

[1] https://docs.python.org/3/library/__future__.html
[2] https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html
[3] https://www.python.org/dev/peps/pep-0238
[4] https://www.python.org/dev/peps/pep-3105
[5] https://www.python.org/dev/peps/pep-3112
[6] https://www.python.org/dev/peps/pep-0343
[7] https://www.python.org/dev/peps/pep-0328

Change-Id: I907008ff4102806a6f7c88572f89f3beb500d9d7

normally, api_interface is treated as internal and security network plane,
use it as default migration_interface is more meaningful.

Change-Id: Ib9f4bcc19147a49dc09bd905dcd06be165a91b5e

Now that the stable/ussuri branch has been cut, we can set the previous
release to Ussuri. This is done in kolla-ansible for rolling upgrades,
and in CI configuration for upgrade tests.

Change-Id: I36f252c77339a6b810413810efd6bb32e0b69e29

Fix glance configuration task to create the backend PEM only on hosts with
glance service enabled.

Change-Id: I641c51761a99828854aafcc1e7354d6932d86659

so that we never have to touch it again (DRY in its fullest).

Change-Id: I83d5a36d1c7c8300cd5879486692bae74ee2289c

This is forwardport of [1].

[1] https://review.opendev.org/730496

Change-Id: I6523b915e0231c28b5cd91f821515f3d47309d66

The Monasca Log API has been removed and in this change we switch
to using the unified API. If dedicated log APIs are required then
this can be supported through configuration. Out of the box the
Monasca API is used for both logs and metrics which is envisaged to
work for most use cases.

In order to use the unified API for logs, we need to disable the
legacy Kafka client. We also rename the Monasca API config file
to remove a warning about using the old style name.

Depends-On: https://review.opendev.org/#/c/728638
Change-Id: I9b6bf5b6690f4b4b3445e7d15a40e45dd42d2e84

Since at least Stein, there is no visible effect from these tasks.
The Kibana dashboard seems to be working exactly the same,
greeting user on the first use with "please configure my index".
I tested on both Ubuntu and CentOS.
In new E*K stack (Ussuri+, CentOS8+) it even causes play errors.

Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Change-Id: Iafc6986cce9cbaa0ea9e219ca85d7d01a61308cf
Closes-Bug: #1799689

you might refer to:
https://github.com/gophercloud/utils/blob/b0167b94122ca14ce50258a760b4e9b22788f0d7/openstack/clientconfig/results.go#L41

Change-Id: Ia326360c412aad9ca4d1735cc6486aa2fce22c1a
Closes-Bug: #1850812

Depends-On: https://review.opendev.org/710217/

Change-Id: I85652f23e487c40192106d23f2cdd45a3077deca

bump api version to v2[1]

[1]: https://review.opendev.org/#/c/700102/

Change-Id: I799f126a30081a85da4f3c41ce705c3756bbe6ba