When deploying with tls enabled in public
endpoints, ansible modules fails due SSL certificates
are self-signed.

This change adds a new variable to allow customization
on which endpoints ansible should connect.
Defaults to admin because admin auth parameters defaults
to admin endpoint.

Change-Id: Ic3ed58cf9c9579cae08a11bbfe6fce983b5a9cbc
Closes-Bug: #1720995

Fix a missing comma in config.json when neutron_plugin_agent is set
to 'vmware_nsxv' or 'vmware_dvs'.

Closes-Bug: #1720380

Change-Id: I088f09a426a5435202176c45a77b1fbc19468f97

Change-Id: Idfc0b4c6f4f5c699cd999662a98862ccc5286a5f
Closes-bug: 1720179

This also sorts the list service_plugins.

Change-Id: I28c12337e56060061a5db13c9a23f8d4b231b1fd

This change adds enable_fluentd option and enables some other log shippers
to be integrated. When enable_fluentd is "no", syslog server is also disabled.
Then, this change also adds syslog parameters to use a syslog server
prepared by users.

Change-Id: I7c83ef7fe30a6b9ab7385bcee953ad07e96b0a83
Implements: blueprint fluentd-enable-option

We need set glance_api_version = 2 in cinder
configure to support upload volume to image.

Change-Id: I6162b94833043edb06b434bc578f4caa47213b94
Closes-bug: #1720048

Change-Id: I6394475f14bb4875be6d924591e4aea533ac2eb6
Closes-bug: #1621404
Depends-on: Ifc4f1d0f1b59b1789011e33c649033eb3cf5b010

When deploying on arm64, common reports error:
stat /usr/bin/ansible: no such file or directory

The reason is ansible is installed to /usr/local/bin/ansible
rather that /usr/bin/ansible
Fix the issue to call ansible directly, to consider both cases.

Change-Id: Ie90bd9c4d7d3a4b7b0aef884351cb58ed13ebd11
Signed-off-by: Kevin Zhao <kevin.zhao@linaro.org>
Signed-off-by: Zhangfei Gao <zhangfei.gao@linaro.org>

When using newer Elasticsearch versions you will receive the following error
when trying to start: elasticsearch | max virtual memory areas
vm.max_map_count [65530] likely too low, increase to at least [262144]

This could be solved by increasing the vm.max_map_count value via sysctl.

Reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html

Change-Id: I9fa7b0222104d68bdfc838637acf5e36c479e6b2
Closes-bug: #1719528

octavia-housekeeping container need certifications to create spare
amphore instances.

octavia-health-manager container need certifications to create stable
amphore instances.

Change-Id: I90b9c4c39f6542bb1ee5f40a8d0a39ae8d0ab2b0
Closes-Bug: #1719063

Closes-Bug: #1719503
Change-Id: I705de11614f2d086bd123ea5b3841f59b5a24666

my_ip is used by iscsi_ip_address in cinder.conf. Configure it to
api_interface_address.

Change-Id: Ib9f9140668f807b26bdaec849fc0cef0a63a8ca0
Closes-Bug: #1719274

The value set for "secure_proxy_ssl_header" should be
"HTTP_X_FORWARDED_PROTO" and not "X-Forwarded-Proto".

Change-Id: I7f4cc4871164ca9096a190101c179daa41e1ae9a
Closes-Bug: #1719325

Added horizon_keystone_multidomain flag. It can be now overriden
in globals.yml. Default set to False.

Change-Id: I6f8f261cf4b9779e57c2443ac219cdddb1731f52

For the genconfig command, master_host will not be defined as it is
defined dynamically in bootstrap.yml.

Co-Authored-By: Stig Telfer <stig@stackhpc.com>
Change-Id: Ib988c8e2de475e9b973fed2f7f752cb2500953c3
Closes-Bug: #1707856

Fluentd config actually used two keywords to named log level:
"log_level" and "severity_label".
This doesn't allow to search and sort ALL logs in Kibana using a unique
field (ex: log_level).
This fix standardize log level keyword naming.

Closes-Bug: #1713410
Change-Id: Ibb2eaf3b6aa21ce6f7945e768e6362c0d40f0507

1. Optimize the yaml format
2. Change the "shell" to "command" for task "fetch secret"
and "cleaning up"

refor to
https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/nova/tasks/simple_cell_setup.yml#L3

Change-Id: Ia6c670ff1349888f6c8a350052e3b170693e12b1

Add config_owner_user and config_owner_group to group_vars/all,
which is user and group of Kolla configuration files in /etc/kolla.

Add become to post-deploy playbook.

Add become to only neccesary tasks in roles:
- certificate
- common
- destroy
- haproxy
- mariadb
- memcached
- rabbitmq

Change-Id: I2aba745a6e3928c52642f64551470fd08cbfd058
Partial-Implements: blueprint ansible-specific-task-become

1. optimize the conmmand format
2. Update the "--os-auth-url", use the {{ keystone_admin_url }}
since it be defined in all.yml

Change-Id: I53278a7b1c43a021eafbd10842355a4c70c47116

neutron-fwaas-dashboard is split into standalone repo. Need enable it
dynamic.

Depends-On: Ic1ff58df2c23db77aace95fd6d4eabbd62227e3b
Change-Id: I37b3258a394a7722b0837d6b1707326d7e37c9ba
Closes-Bug: #1719147

infra.rabbitmq tag does not match in fluentd

Closes-Bug: #1718874
Change-Id: I92733a4f275baa93b0c3a6ddbdc6801aec534867

This patch includes three unrelated fixes.

Make qemu use nova user in centos
Libvirt 3.2.0 (latest version in centos) seems to
have changed behavior of dynamic_ownership.

Pin ansible to <2.4 to make ara work in gates
ARA does not work yet with ansible 2.4, this change
pins to lower version to make gates work.
Revert once ara works with 2.4

Disable selinux for oraclelinux and centos.

Co-Authored-By: wanghongxu <wang19930902@gmail.com>
Co-Authored-By: Jeffrey Zhang <jeffrey.zhang@99cloud.net>
Change-Id: Iac8bec19437192cd198d58f71c6ed0a65a76f820
Closes-bug: #1718541

Change-Id: I99cca8c3830077736f71a7ab1abd3818688f9bb1

Option 'bind_host' from group 'DEFAULT' is deprecated for removal[0],
please use option 'bind_host' from group 'api_settings' instead. bind_port
option are the same.
The default value of api_handler is queue_producer, we did not configure
it. So delete api_handler option.

[0]https://github.com/openstack/octavia/blob/master/octavia/common/config.py#L45

Change-Id: I4e9c1d40bcb497f147ea38d4f3c6d78c181fa20b
Closes-Bug: #1717190

When an external Ceph cluster is used, the "filesystem_store_datadir"
option is set in the "glance-api.conf" configuration file.

It should not, it's because of this condition:

  {% elif enable_ceph | bool and glance_backend_ceph | bool %}

When external Ceph cluster is used "enable_ceph" is false and
"glance_backend_ceph" is true.

glance_backend_ceph variable should be enought for this condition.

Change-Id: I2a2ab420727888cfd9fcbc4bd30a08410163b36e
Closes-Bug: #1718728

Added configuration to enable Oracle ZFS Storage Appliance:
https://docs.openstack.org/cinder/pike/configuration/block-storage/drivers/zfssa-iscsi-driver.html

Change-Id: Id5807f0d4567e16a68283cace7e126eddc4dea20
Implements: blueprint zfssa-cinder-support

progname is actually only fullfilled for Openstack logs and infra logs.
They are missing for program logging in RSYSLOG: HAPROXY and SWIFT.
When using Kibana, "progname" field appears empty, hence it's difficult
to know where logs come from.

Change-Id: Iae98af083cfb79d2a64fa0b70c86b0a01f7a336f
Closes-Bug: #1716051

WSGI configuration is missing the directive
"WSGIApplicationGroup %{GLOBAL}" after
WSGIProcessGroup" in the horizon template.
Of all WSGI configuration templates it is
the only one that does not have the
"WSGIApplicationGroup" line.

Change-Id: I3001901abbaae842f49179b6febf844337431afc
Closes-Bug: #1717922

New tacker has removed nova heat configure items,
but the tacker role is still using it.

In addition, the ceilometer and aodh are backend OpenStack
components, the configuration of feature in tacker does not depend
on them directly.

Change-Id: I475ff763475ed699a1e7498cc9898bd71d00ae7c
Closes-bug: 1718113

kolla designate DNSaaS makes use of containerised bind9 servers
as it's default designate_backend. These can be disabled by
setting designate_backend to "no". default: "bind9"

This commit adds two new properties:
1) designate_backend_external
 which can be enabled by setting it to 'bind9'. default: "no"
and
2) designate_backend_external_bind9_nameservers, which can
 accept a csv list of all the external server addresses.
 (default: "")

The following attributes should either be set:
'internal' (the default)
 designate_backend: "bind9"
 designate_backend_external: "no"
 (designate_backend_external_bind9_nameservers is ignored)
or
 'external'
 designate_backend: "no"
 designate_backend_external: "bind9"
 (designate_backend_external_bind9_nameservers must be populated)

Configuration override files to align with external bind9
dns servers must be supplied manually,
 /etc/kolla/config/designate/rndc.key
 /etc/kolla/config/designate/rndc.conf

Change-Id: I8dbe6fd4fe7820b9143604d89e8399b07e07c3fd

Disable the additional watch timer (enable_watch_timer).
Setting this parameter to false will significantly reduce CPU and I/O
consumption when tailing a large number of files on systems with inotify
support.

Change-Id: Ib432e6cdece01dbb94b3d2f3d7fbdd04b81d25fa

It's supposed to be working now https://review.openstack.org/475273

Change-Id: I5ae4f5f8ca977f7343cb135e41eb2d0703c37024
Closes-Bug: #1713609

In some scenarios it may be useful to configure custom fluentd outputs
to forward logs to a logging service other than elasticsearch.

This change supports configuration of fluentd outputs by placing
output configuration files in /etc/kolla/config/fluentd/output/*.conf.

Change-Id: I3c0b271d88dbb307ba3a23546e29c72e8baeca55
Implements: blueprint fluentd-custom-outputs

Actually Openstack services configuration can be overriden using many
files:
- /etc/kolla/config/<< service name >>/<< config file >>
- /etc/kolla/config/<< service name >>/<<host>>/<< config file >>
- /etc/kolla/config/global.conf
- /etc/kolla/config/database.conf
- /etc/kolla/config/messaging.conf

Only per-service configuration is actually documented here:
https://github.com/openstack/kolla-ansible/blob/master/doc/advanced-configuration.rst#L164

Allowing to globally modify service configuration can be perform too,
but it can be done in 3 different manners, all not documented:
- /etc/kolla/config/global.conf
- /etc/kolla/config/database.conf
- /etc/kolla/config/messaging.conf

database.conf and messaging.conf seems redundant with global.conf.
In order to simplify codebase it seems logical to remove them.

Documentation has been added for overriding configuration globally and
release note has been added too.

Closes-Bug: #1682479
Change-Id: I5d922dfc0d938173bad34ac64e490b78db1b7e31

HyperV Nova needs some nova.conf changes to work properly.
More precisely: 'auth_plugin' becomes 'auth_type'.

Closes-Bug: #1716956
Change-Id: Ic2342e2303b780398f81b3024fe5b11111e34a6e

This fix removes unnecessary deep nesting of host groups
for iscsid service in case of Ironic hosts.
Before: iscsid -> ironic-conductor -> ironic -> control
After:  iscsid -> ironic -> control

Change-Id: Ie5393368ecbd3830f0ca01233d7b4a8ba782619a
Closes-Bug: #1716935

Change-Id: I366c2124a778c5b0b22a8fe369d603adad75ebbe

Barbican-api log is a uswsgi process and fluentd expects as
openstack service process.
This change moves log type to uswgi group.

Change-Id: Ifaf5645d0d19e133e41de0c55a55321fccfc391f
Closes-Bug: #1716513

TrivialFix

Change-Id: Ia54ee5cae2ffcdcca24cb162699e09b0808a1037
Depends-on: Ida2ed62eaba8908fb0bd50bb0be00fb5f9b1adc3

Change-Id: I1267e9d49f8190e4998d6a8164b1e68c613de2bc
Closes-bug: #1712780