Like other WSGI services in Kolla Ansible, the Horizon WSGI application
handles log output via the `wsgi.errors` object. See [1] for further
information. The problem is that this log output is written to a file called
`horizon.log`, causing it to processed as an 'Oslo log' in the Fluentd
processing pipeline. Since the log format doesn't match the expected format,
this results in parsing errors.

This fix renames the log file and adjusts the format to match other WSGI
applications. The logs are then processed in the same way as other WSGI
application logs, resolving the issue.

[1] https://modwsgi.readthedocs.io/en/master/user-guides/debugging-techniques.html

Change-Id: I93777d1c53920f5470c78356e6b3a4064fbe04b4
Closes-Bug: #1898174

The patch [1] mentioned below added the jobboard
functionality to the octavia role, but unfortunately
it incorrectly implemented the functionality of users
and rules for proxysql.

This patch fixes this bug.

[1] https://review.opendev.org/c/openstack/kolla-ansible/+/888588

Closes-Bug: #2044293
Change-Id: I6524fabad19b438113db4affe05f5586db99dff4

Closes-Bug: #2043831
Change-Id: I010fabd255d93d5329de82af2b5d21c8fa7d93c4

Closes-Bug: #2044226
Change-Id: I5e17152584b758c9ca4f1cc14520337f979584b7

This avoids generating an empty [oslo_policy] section in nova.conf when
no custom policy file is defined.

Change-Id: I23fae8387573e7f37eda0f2a09cd937239afd93f

Closes-Bug: #2043829
Change-Id: Ic4cbaf592a2699d9c0312c575f68613c8681239f

See:
https://grafana.com/docs/grafana/latest/administration/provisioning/

Closes-Bug: #2043828
Change-Id: I9ed07dc8c995adddf6d89838cd515af93d10bd00

Set the openstack exporter HAProxy backend server timeout to
``prometheus_openstack_exporter_timeout`` to ensure that scrapes
that take longer than haproxy_server_timeout don't timeout.

Closes-Bug: #2006051
Change-Id: I44841a6b6fa5bf659cace06295d18c093ad7f927

Introduce keystone_federation_oidc_additional_options variable

Change-Id: I39b9f35dab6f4e3ac2fcb505aabd2589e6e2ca69

docker_restart_policy: no causes systemd units to not get created
and we use it in CI to disable restarts on services.

Introducing oneshot policy to not create systemd unit for oneshot
containers (those that are running bootstrap tasks, like db
bootstrap and don't need a systemd unit), but still create systemd
units for long lived containers but with Restart=No.

Change-Id: I9e0d656f19143ec2fcad7d6d345b2c9387551604

Change-Id: I7df734cf15eba1af4da92f9c4ef12cc761442ca1

This avoids the need to use a proxy, or some other means, to connect to
Prometheus. This is disabled by default and can be enabled by setting
enable_prometheus_server_external to true.

Change-Id: Ia0af044ff436c2a204b357750a16ff49fcdfec45

Depends-On: https://review.opendev.org/c/openstack/kolla/+/899773
Change-Id: I016c7a54ee2c43b6bbad0cb3eb3fe216f3d66238

Add support for automatic provisioning and renewal of HTTPS
certificates via LetsEncrypt.

Spec is available at:
https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https

Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347


Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
Implements: blueprint letsencrypt-https
Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106

Enable the jobboard feature for the Octavia amphora provider. This
requires Redis as a dependency, a precheck is added to ensure proper
configuration.

https://docs.openstack.org/octavia/latest/install/install-amphorav2.html

Change-Id: Iec3c8a4b4e257557dc8ec995c41d0ad7e88e13e2

Change-Id: I4aa6dc90c6e6da6cd5fa94ad9ea02396e9c60a8b

Change-Id: I8f25c7619c45157f6354fb42bf9f28ec194389ed

When Neutron QoS is enabled, the QoS extension needs to be defined
in the sriov_agent.ini file.

Closes-Bug: #2041863
Change-Id: Id0de181df06a9e382a1483b32c12a8b5da1b71a9
Signed-off-by: German Espinoza <gespinoza@whitestack.com>

Kolla Ansible should deploy Glance and Cinder Backup with
S3 backend support working out-of-the-box.

The S3 backend had been re-introduced in Ussuri after being
deprecated around the Mitaka timeframe, and having some local
object storage options is nice for testing..

Closes-Bug: #1977515
Change-Id: I4ca58382d1ee568bfca2ad108495422163f81260
Co-authored-by: Juan Pablo Suazo <jsuazo@whitestack.com>
Co-authored-by: Maksim Malchuk <maksim.malchuk@gmail.com>

This change adds basic deployment based on Podman
container manager as an alternative to Docker.

Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com>
Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>
Signed-off-by: Petr Tuma <p.tuma@partner.samsung.com>
Change-Id: I2b52964906ba8b19b8b1098717b9423ab954fa3d
Depends-On: Ie4b4c1cf8fe6e7ce41eaa703b423dedcb41e3afc

Change-Id: Ib659203d83201d24054c52db0ab33c3f7ee2304f

Related to ansible-core bug [1].

[1]: https://github.com/ansible/ansible/issues/81945

Change-Id: Idede07a5f0fd1a3ee63e1c54a263e358e95b3a86

Apache grok pattern updated to match the size of response in bytes,
the time taken to serve the request and the user-agent that made
the request.

Change-Id: I8ce6e6e10bbf55ef8aa21f983f4a6c4b6dc24402

Adding missing group_vars for gnocchi service.
Using proper variables in haproxy config for vitrage and venus services.

Closes-Bug: #2038904
Change-Id: I06e8f29440c13864a866ea03ce0a0821fbe846f8

Kolla have updated the RabbitMQ image version from 3.11 to 3.12. While
in 3.12, there are a few feature flags that is marked as required [1].
If those are not enable, RabbitMQ will fail to start after upgrade.

This commit added additional required feature flags to the
rabbitmq_feature_flags list.

[1] https://www.rabbitmq.com/feature-flags.html#core-feature-flags

Change-Id: I401bbaae059bca5c656269f65ac8b7bff0aefae2

Change-Id: Ic153a91beb30daa334ccbb0430ce8340bd6c480f

Closes-Bug: #2031237
Change-Id: I7a4eaeab0c106ebdcb4d4cf9825c53dd8ad62dbf

_member_ role is a long not used default keystone role,
for instance Horizon moved to use member role from yoga [1]

[1] https://docs.openstack.org/horizon/yoga/configuration/settings.html#openstack-keystone-default-role

Closes-Bug: #2038314
Change-Id: Idc9bce82c682e37c5bea10c93577091b85f3ad45

Those logs are haproxy logs which are pushed through fluentd
syslog input (just like ,,normal'' haproxy logs) and we don't
parse them at all.

Closes-Bug: #2029128
Change-Id: Ic2529e905ebbec6180179b89568f9bd5a0581035

Following Monasca initial removal in [1]

[1]: I6fc7842bcda18e417a3fd21c11e28979a470f1cf

Change-Id: I94d6f102e8da3882f37f3007639b917c49f907a9

Followup on I2e00d3e9193a3052d43a228915ea249794490afe.
Fixes an issue with wrong copy/paste.

Related-Bug: #1850924
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
Change-Id: I979a4e5b534f105a2e81f88f9675feddc883490a

* Zun currently has a dependency on a combination of Docker and
  etcd that is no longer installable (or supported) in newer
  distros.
* These components are core dependencies of other systems and
  vendoring them will be very painful.
* Work to update Zun past this is scheduled for the 'C' cycle.
* If Zun regains compatibility, backports to this series will be
  considered.

Change-Id: I6a2a4ffdcaf1c4fab1097e94d5f255ffb9a2947d

It will check the setting of neutron_plugin_agent,
if it is set to "ovn" or "openvswitch", and run
container and volume checks to make sure the other
agent was not already deployed.

Change-Id: Ie00572f3ff9d3500abd5519bd472e2134c318886

This change introduces haproxy_enable_http2 to let operators enable
http/2 on HAProxy frontends when kolla_enable_tls_external is enabled.

Change-Id: I2e00d3e9193a3052d43a228915ea249794490afe
Closes-Bug: #1850924

Closes-Bug: #2036741

Change-Id: Ib448d04e43dff78e344064161beadae917c41206

Use HTTPS to scrape etcd metrics when etcd TLS is enabled.

Change-Id: Iaff10d5314a8dc5b07137d93c269f1ac24cf63de
Closes-Bug: #2036950

Change-Id: I901c0a57efcb6cbaaac43f64f2243fff7d7980c8

* keystone_enable_federation_openid
* enable_keystone_federation

Closes-Bug: #2036390

Change-Id: Ieef1dce006c339643ad4fa544218c6482c2ad32c

Allow more flexibility by adding a host specific template. Also
using the merge_yaml action allow us to drop the logic around deciding
which template to use.

Change-Id: I41a3226679c622e5e98df074cee195e8436ea45b

Initially Ubuntu/Debian used /var/run/openvswitch as default OVN run dir,
it seems it has changed long time ago - but we haven't picked that up on latest
OVN DB refactor.

Adding in OVN and OVN upgrade Debian jobs to enhance coverage.

Closes-Bug: #2035584

Change-Id: I78967c4499269578ac921ad9a553946b65e1293f