Change-Id: Ie6fd05b52592ad48fd7acbd6b7e9a6f48ffd1150

Skydive need to use internal endpoint
for join keystone like other service.

Change-Id: I6fd76a035ab316f21d483a28a25bfb94c9ed6b95
Closes-Bug: #1747401

Remove duplicated [oslo_policy] in magnum.conf.

Change-Id: I69c82e31d7041d7e8f9c31ba1bf54f0906f2a6dc
Closes-Bug: #1754593

Till now we've been flusing iptables in the gates to allow cross node
communication in the multi node ceph jobs. This raised security
concerns, in particular it exposed memcached to the external net.

This patch uses the infra provided role 'multi-node-firewall' in order
to correctly configure iptables. Thanks to Jeremy Stanley and Jeffrey
for help with this.

Closes-Bug: #1749326
Change-Id: Iafaf1cf1d9b0227b0f869969d0bd52fbde3791a0

This reverts commit 2a4ce0b8.

Change-Id: I52efd29791a230df1ce7e3acde4b7184aec34150

Ansible provide script module to run shell script, The local script at
path will be transferred to the remote node and then executed, so no
need to copy script to remote node and use shell moulde to run it.
this patch optimise it.

Change-Id: If774502b66652f25593cda137cc8a5baefbd9695

Change-Id: Ia9a7b76a9db4a149d9e0df16ac576ecd706df22b

CVE-2018-1000115

Change-Id: I30acb41f1209c0d07eb58f4feec91bc53146dcea
Closes-Bug: #1753425

Change-Id: I31969667ab86f61d38752954cb0e565ad7e41970
Closes-Bug: #1752760

Change-Id: I8ee8b4198ccf2f79fdc1acc3a303ede18960a2a1

Change-Id: I1f721a3e9ad3d1a937e05f1d0d53c810b9f2ac39

Change-Id: I653e16270aab539edcec6d8622f0a1c06d04b492

The original code assumes that ElasticSearch will be deployed
on the same node as Kibana. This isn't always the case. When
they are not on the same node, Kibana will not be able to
connect to ElasticSearch and deployment will fail on the task:
'kibana : Wait for kibana to register in elasticsearch'.

A second advantage of making this change is that Kibana won't
break if ElasticSearch goes down on the node that it's running on
when there are additional ElasticSearch instances on other nodes.

A disadvantage of this change is that queries from Kibana to
ElasticSearch will no longer be local.

Closes-Bug: 1751817
Change-Id: I02ab2e7b1eb963b33e29c8f649cc9db0d63316f7

use systemd module to reload the docker service, rather than
command

Change-Id: I2e3b2299365701a08de4025d6ad34cb492b33fda
Closes-Bug: #1751690

when Manila use ceph as backend, Manila will pull keyring
from ceph mon node [0], but the site.yml missing it.

[0]: https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/manila/tasks/ceph.yml#L18

Change-Id: If8f0b9f186a27d9a86227cd5e5ce2405bf57749e
Closes-Bug: #1751534

Change-Id: Ifc0f1e356dd6a5c194d00ab20f3122d17c7223cc

This is mainly kolla-ansible installation part

Change-Id: Iab14884cfc037bc3cb8055db487c53aa14da070f

Change-Id: I1d24d4a90a6ab4abc6a3b24c0334b380d53e896a

keystone-ssh is required by keystone-fernet. So start keystone-ssh
container before keystone-fernet.

Closes-Bug: #1751224
Change-Id: Ie1c8ae185549acc3dd87a2c5f0356443ea7924a5

We have pin keyston to queens release which supports UUID token through
https://review.openstack.org/546475, let us use UUID in queens and
migrate to fernet in rocky cycle.

This reverts commit df0bf190.

Change-Id: Ifb0112315b5047461ce0bf02c754cc0beac52d9a