CVE-2018-1000115

Change-Id: I30acb41f1209c0d07eb58f4feec91bc53146dcea
Closes-Bug: #1753425

Change-Id: I31969667ab86f61d38752954cb0e565ad7e41970
Closes-Bug: #1752760

Change-Id: I1f721a3e9ad3d1a937e05f1d0d53c810b9f2ac39

Change-Id: I653e16270aab539edcec6d8622f0a1c06d04b492

The original code assumes that ElasticSearch will be deployed
on the same node as Kibana. This isn't always the case. When
they are not on the same node, Kibana will not be able to
connect to ElasticSearch and deployment will fail on the task:
'kibana : Wait for kibana to register in elasticsearch'.

A second advantage of making this change is that Kibana won't
break if ElasticSearch goes down on the node that it's running on
when there are additional ElasticSearch instances on other nodes.

A disadvantage of this change is that queries from Kibana to
ElasticSearch will no longer be local.

Closes-Bug: 1751817
Change-Id: I02ab2e7b1eb963b33e29c8f649cc9db0d63316f7

use systemd module to reload the docker service, rather than
command

Change-Id: I2e3b2299365701a08de4025d6ad34cb492b33fda
Closes-Bug: #1751690

Change-Id: Ifc0f1e356dd6a5c194d00ab20f3122d17c7223cc

Change-Id: I1d24d4a90a6ab4abc6a3b24c0334b380d53e896a

keystone-ssh is required by keystone-fernet. So start keystone-ssh
container before keystone-fernet.

Closes-Bug: #1751224
Change-Id: Ie1c8ae185549acc3dd87a2c5f0356443ea7924a5

freezer use elasticsearch as database storage, and do
not support mariadb for pike release [0][1]. this PS
to remove the useless mariadb setting.

[0]: https://docs.openstack.org/freezer/pike/install/db-install.html
[1]: https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/freezer/templates/freezer-api.conf.j2#L34

Change-Id: I85124a556b809b916e760415a9605c3c6724215c
Closes-Bug: #1750816

The grafana local admin username can be configured by overriding
the admin user field in the grafana.ini file. However, this will
fail when kolla-ansible attempts to configure any enabled
datasources for grafana because the local admin password is
hardcoded to 'admin'. This change allows the grafana local admin
password to be configured via group vars so that the correct
username is used when configuring datasources.

Closes-Bug: #1750408
Change-Id: I0962200894f7a0452da1c249a68f9230b6fab13f

Murano failed to deploy due to outdated options - it tried to
issue v2.0 Keystone requests instead of v3. With new options that
are similar to other projects deployment succeeds.

Change-Id: I1970641e47fa6f94c2c6427ef49b3160d64c33ed
Closes-Bug: #1750373

Change-Id: I67ea2b1a91dfd61341ae2e5bcd82d1cf0597fe9c
Closes-Bug: #1745957

'deployment' hosts don't need api interface. Previous fix checked
if hosts belong global groups like [compute] or [control] which
is not correct because uses can create own groups and the check
won't work there at all. Here the logic is reversed - we blacklist
groups that don't need api_interface.

Change-Id: Ibaa94004016ba41a2ae5700c48522e254c6ee239
Closes-Bug: #1732846

If control hosts have different names of interfaces one can set
api_interface variables per host. Deployment of keystone fails
because rpc_transport_url and notify_transport_url variables
use bare api_interface instead of one from hostvars.

Change-Id: I8bb4aa2953cf4ba63ef6815f2504d35e5aa0a07b
Closes-Bug: #1748473

This change makes it so that if preconfigured database users are used,
the attempt to change the log_bin_trust_function_creators mysql
variable isn't made anymore.

Also updated the upgrade docs

Change-Id: I356313952d435de6d3b5444c0dd8a71f45aee452
Closes-Bug: 1748269

Closes-Bug: #1748347
Change-Id: I9fffc86e7c69ac5edb93c88636e7d49f73544d85

If enable Ceph MDS and RBD services, they are not conflicting
with Swift service.

Fix the check condition to make sure both Ceph and Swift exist.

Closes-Bug: #1747592

Change-Id: Icc6806125ce72992f7dff00c30d591ffb737a0c6
Signed-off-by: Tone.Zhang <tone.zhang@arm.com>

If we use multiple skydive analyzers, we need to add this configuration.
Works with one node.

Change-Id: I9b52bf184e269d314e2af2ac80dc45557e3533af

Ansible recommends to use apt module instead of apt-get.
This patch fixes install.yml and pre-install.yml accordingly.

Change-Id: I3241ce332e7cf522786e78280643440a30a23875
Closes-Bug: #1747436

Ceph mon have a configure about "mon_max_pg_per_osd"
and default value is 300.
When pgs per osd is exceeded, pool creation will be failed.
But kolla-ansible ignoring this, so user may difficult to find
a main reason for the failure.
We need to catch an error when pool creation is failed.

Change-Id: I92493584faad9bc550fdeeb96b827537daafd0b8
Closes-Bug: #1747414

Follow up of https://review.openstack.org/#/c/454752

Change-Id: I20a3677b30ef6133fc3456b0449464a6a88d1581
Closes-Bug: #1747375

1.Fix the invalid value about selinux policy
2.Update description of task about selinux.The permissive mode
need enable selinux.The parameter named "disable_selinux" is not good.
In order to customize selinux modes, we need a new
parameter named "selinux_state".

Closes-Bug: #1749046
Change-Id: I20c084cf2e46cc0de149afbd34c6dcb77a1051f4

the wait function in docker 3.0 return a dict now.

Closes-Bug: #1746748
Change-Id: Ice87128a936e36a0d7eb75c1ffd57dae39d89a64

This to support configuration on ceilometer services for XenAPI.
1. set hypervisor_inspector as xenapi
2. Confiugre the section of [xenapi] for XenAPI connection

For details, please refer to the config doc:
https://docs.openstack.org/ceilometer/latest/configuration/index.html

Change-Id: I4fc649d927031886c694507b3e8a686646a61ef7
blueprint: xenserver-support

The purpose of this change is to improve upon
https://review.openstack.org/#/c/531122/

- Moved vars inside the defaults/main.yml file
- Made the regex for the lineinfile safer

Change-Id: Id581c0b36f3d4bd61d3627b8364b79296b967387
Closes-Bug: 1746567
Related-Bug: 1682153

refer to https://github.com/openstack/kolla/blob/master/kolla/common/config.py#L22

Change-Id: I24197663e6456d257690413ead7a51ce9203e97c

In recover_cluster.yaml playbook the task to find the highest
seqno/Global Transaction ID is no longer relying only on grastate.dat
Instead it now follows the recommendations from galera cluster website
http://galeracluster.com/documentation-webpages/restartingcluster.html

Closes-Bug: 1682153

Change-Id: I5fc3eaa8baee659576c4c39aef9cfd351c8e9af7

Apply Cinder database migration procedure:

[1] https://docs.openstack.org/cinder/pike/upgrade.html

Depends-On: I9a847b0a916a85d8f2622e93734330da5122f0d8
Change-Id: I934c38cb5366f0b3a65115b4cdd19878efec7ebc

Skydive need to use internal endpoint for join keystone like other service.

Change-Id: I1f9c5a6d61547c81524c9c04fec48ed720033867
Closes-Bug: #1745949

when non-root (become), the permission changed is necessary,
but some roles is missing, the patch to add it.

Change-Id: I987becde489f4b509b32edc1deceabfa2d2e1b74

Copy custom config files to remote hosts.
with_first_found items are not used.

Change-Id: I78faaded2c2b738454e6c6d971fd28994c753fb8
Closes-Bug: #1745559

- Keystone
- Glance
- Nova
- Cinder

This will copy only yaml or json policy file if they exist.

Change-Id: I4a9415d82322aed68c9b7650bdf346f58fa49e2a
Implements: blueprint support-custom-policy-yaml
Co-authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>

Adding following role which is reuqired by octavia services

- load-balancer_observer
- load-balancer_global_observer
- load-balancer_member
- load-balancer_admin
- load-balancer_quota_admin

Change-Id: I6f351c96915b09cb9a6ef716515b45785d62cb90
Closes-Bug: #1745915

- Vitrage
- Watcher
- Zun

This will copy only yaml or json policy file if they exist.

Change-Id: I913b3b067237cc4694894cc00bcc363127dd3806
Implements: blueprint support-custom-policy-yaml
Co-authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>

Missing container status check in recreate_or_restart_container,
this causes if the container is not running (kolla-ansible stop),
to not be started with deploy/reconfigure/upgrade if any other param
changes.

Change-Id: I5cff5f367e963ba8b1807ec46469da817e40e468
Closes-Bug: #1714015

- Ceilometer
- Gnocchi
- Rally

This will copy only yaml or json policy file if they exist.

Change-Id: I59f3376ab9fb6fb83577465a6c9096764b9f19c0
Implements: blueprint support-custom-policy-yaml
Co-authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>

- Sahara
- Searchlight
- Senlin
- Tacker

This will copy only yaml or json policy file if they exist.

Change-Id: I97c8bf300f14ae6d7c55c5f8962c5781cee2c40a
Implements: blueprint support-custom-policy-yaml
Co-authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>

This commit contains two fixes:
1. ``of_listen_address``: We use the xenapi's facts directly, so
that we can avoid depending on facts gathered by setup for hosts;
This is useful when deploy on the role of neutron only (--tag neutron);
2. ``local_ip``: Get the proper IP for tunnel. It should be chosen
from dom0's IP which is in the same network where tunnel interface
is connected.

blueprint: xenserver-support

Change-Id: I61bbd6499323e3fddd6293a0df6baec34dbddf23

When enabled provider networks; the neutron-openvswith-agent-xenapi
should use proper bridge_mappings which should have dom0's bridges
where the VMs' vifs actually connected to for the interfaces defined
in the configure option of *neutron_external_interface*.

Depends-On: I9a6bebe19ed488bb2173d5dc2daa14e236411243
Change-Id: I44f59c69d25b8400e1b936fcdf8f21b5c4168f1f