Adds support to the 'kolla-ansible certificates' command for generating
certificates for libvirt TLS, when libvirt_tls is true. The same
certificate and key are used for the libvirt client and server.

The certificates use the same root CA as the other generated
certificates, and are written to
{{ node_custom_config }}/nova/nova-libvirt/, ready to be picked up by
nova-libvirt and nova-compute.

Change-Id: I1bde9fa018f66037aec82dc74c61ad1f477a7c12

Enables zun to access cinder volumes when cinder is configured to use
external ceph.
Copies ceph config file and ceph cinder keyring to /etc/ceph in
zun_compute container.

Closes-Bug: 1848934
Change-Id: Ie56868d5e9ed37a9274b8cbe65895f3634b895c8

This gets rid of one of the steps in the authentication flow.

Closes-Bug: 1930055
Change-Id: I4ed4651b55a912f1d9aec7277bae6bb4776f1e0a

Custom themes support for horizon deployment.
 - horizon role task added for copying theme files
 - added theme copying into the container in templates
 - docs and reno updated

Change-Id: If9982c8e18be31772cb031ef72b7eebd4d768be5
Co-Authored-By: Jakub Darmach <jakub@stackhpc.com>
Depends-On: https://review.opendev.org/c/openstack/kayobe/+/824565
Depends-On: https://review.opendev.org/c/openstack/kolla/+/826672

This fixes a bug in registering identity providers

The bug was caused by a missing `=` in the openstack command

Add the missing `=` after `--os-user-domain-name`

Closes-Bug: #1959022
Change-Id: I73f80cd2c81a3944de0933e60f5768956a1a3b70

Overrides default fluentd buffer config to stop log files from using
datestamped filenames, allowing logrotate to manage them.

Closes-Bug: #1940118
Change-Id: I40c4e209470d21e0a02fd447fb628acfdae9fa9d

The value of node_custom_config should is {{ node_config }}/config,
when specified using --configdir

Change-Id: I076b7d2c8980ddd3baa28f998f84a6b7005dc352

There are multiple Neutron extensions that can be used for DNS
integration. The "dns" extension has only minimum functionality, for
most deployments either "dns_domain_ports" or
"subnet_dns_publish_fixed_ip" would be used, with the latter being a
superset of the two others [0].

[0] https://docs.openstack.org/neutron/xena/admin/config-dns-int-ext-serv.html#use-case-3-ports-are-published-directly-in-the-external-dns-service



Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I1056bddfd49265ffe21b4d000898d72bba3ebfad

Change-Id: I8bf5453c6943fd2ad8912e5d80af179296ada894

This change enables the use of Docker healthchecks for ironic-neutron-agent services.

Change-Id: I80f8319b2cf2e4ae09904a08532cde5ec0385fa3
Implements: blueprint container-health-check

There is no explanation for why this option was bumped to 1 MB instead
of the upstream default. This has been the case since the original
barbican role commit in 2016.

Restore upstream default in Yoga.

Change-Id: Ib0245f44d2b049f7e2254d8d2ea4b2080a8d62dd

In the Yoga cycle we no longer need kolla chrony container removal
procedures.

Change-Id: I4dc246cf0fd68838470bf9e9bf749fa9be4d6670

Barbican has recently bumped max_allowed_secret_in_bytes from 10 KB to
20 KB since the original value was too small for some certificates [1].
Remove custom value from the barbican.conf template, which anyway was
the same as the default configuration before the recent upstream change.

The upstream change was backported to Wallaby and has been proposed to
Victoria, Ussuri and Train [2], so this change should be backported too.

[1] https://review.opendev.org/c/openstack/barbican/+/783381
[2] https://review.opendev.org/q/I59d11c5c9c32128ab9d71eaecdf46dd2d789a8d1

Change-Id: I83e4cb48192c8024650a8d347363f6babb75ad90
Closes-Bug: #1957795

They seem to think ping is too dangerous for normal users.

Co-Authored-By: Pierre Riteau <pierre@stackhpc.com>
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/824903
Change-Id: I30c2a7b6850350901b15fe196175508634c8e9a5

Access to console of any zun container fails when
kolla_enable_tls_external is true.
This is due to the protocol of the base_url of the websocket_proxy
section in zun.conf is hardcoded to 'ws'.
[base_url = ws://<external_fqdn>:<port>]

This fix adds a new variable zun_wsproxy_protocol
and sets it's value to 'wss' when kolla_enable_tls_external is true
or to 'ws' otherwise

Then the base url's protocol of the websocket_proxy section
in zun.conf is set by zun_wsproxy_protocol
[base_url = "{{ zun_wsproxy_protocol }}://<external_fqdn>:<port>"]

Closes-Bug: 1957117
Change-Id: Ibd9ca6e40ee8c265775b0657d318aa3f82e4cccb

Change-Id: I547ab4b05aa14ed3bbee8be2dc77a6840d4816f6

Move new variables added in I4d694d6224c813285d228d6bc7eece5731db1078 to
role defaults.

Change-Id: Ie09a2dbae2701cb18fd1eb5bfab76e82f9920fb3

This is required as nova_compute tries to reach my_ip of the other
node when resizing an instance and my_ip is set to
api_interface_address.

This potential issue was introduced with [1].

[1] https://review.opendev.org/c/openstack/kolla-ansible/+/569131

Closes-Bug: #1956976
Change-Id: Id57a672c69a2d5aa74e55f252d05bb756bbc945a

Closes-Bug: #1954723
Change-Id: I6ffc8caae1aef757d37c629fbc05bb129f80147b

Some ID provider configurations do not require a certificate file.
Change the logic to allow this, and update documentation accordingly.

Change-Id: I2c34a6b5894402bbebeb3fb96768789bc3c7fe84

rabbitmq starting from 3.8.0, built-in Prometheus support,
prometheus plugins are enabled by default, when the environment is
"enable_prometheus is no", rabbitmq role will disable prometheus plugins

Closes-Bug: #1885106

Change-Id: I4d694d6224c813285d228d6bc7eece5731db1078

Also bumps the minimum to 4.

Change-Id: Ia373f9cc3bb69eba0288bbb3e497e8cadb7cc4d3

Moved the DockerWorker class from module file into its separate file
in module_utils directory for future extension.
Unit tests changed accordingly.

Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com>
Co-authored-by: Martin Hiner <martin.hiner@tietoevry.com>
Change-Id: Ia2a471a9a2805e13b2c20dbf8a7297c23231aae3

We are not using it anywhere (metadata agents are using internal network),
so let's disable it by default.

Change-Id: If06db5030b0f09e20ef506c3b3ab39c3573b5f3d

Kolla has removed the Volume V2 API by default since OpenStack Wallaby.
However, openstack-exporter attempts to use the Volume V2 API by
default, resulting in clean installs failing to fetch Cinder metrics
in Prometheus.

This patch updates the clouds.yml configuration file for
openstack-exporter to use the Volume V3 API instead.

Closes-Bug: #1938194
Change-Id: Ifbb601be3ef1a1e853d5a7e832adf556c0ae38b9

Change-Id: I5d484ba10c8d2a924801d5f8223845e28023c345

glance_api_version and os_region_name are removed from cinder.
see: https://docs.openstack.org/cinder/xena/configuration/block-storage/samples/cinder.conf.html

Closes-Bug: #1830997
Change-Id: I751bfe64d47935f183ff2ca891ec56f61e618009

This patch also configure delete indices action before close indices.
more info check curator source code[0].

[0] https://github.com/elastic/curator/blob/ac5db911a1b4266908540bbaf44f697be85bb028/curator/cli.py#L217-L224

Change-Id: I9fb4b25514f5890adfac2f4007ec4a819fc9f566
Closes-Bug: #1954720

Role vars have a higher precedence than role defaults. This allows to
import default vars from another role via vars_files without overriding
project_name (see related bug for details).

Change-Id: I3d919736e53d6f3e1a70d1267cf42c8d2c0ad221
Related-Bug: #1951785

After we remove the problematic, legacy "parser" plugin, the
config only needs the new, modern syntax.
This removes warnings that were logged.

Depends-On: https://review.opendev.org/c/openstack/kolla/+/823071
Change-Id: I33aa06de6ce88288769a8291ebd59e78e07cdbaf

This commit added ovn_sb_connection to octavia.conf otherwise it will
try to connect to ovn-sb-db using the default address which is
127.0.0.1 while the ovn-sb-db listen on the IP address of the
api_interface.

Closes-Bug: #1950111

Change-Id: I9cb9a0365d00ffd70562b4b3e83493ec09bd52c2

To satisfy the needs of the modern parser plugin.

Needed-By: https://review.opendev.org/c/openstack/kolla/+/823071


Co-Authored-By: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I2b748d0544c14bebefe8c62aa5aafaaa5371ce53

We stopped using this file in Queens
(https://review.opendev.org/494635), but the file was not removed at
that time.

Change-Id: Ibe5fb291e7c39965f5c4ff5ee4ea0bb1f8e6e9c2
Closes-Bug: #1840158

We no longer have to support multiple fluentd versions and rely
on the workaround.

Change-Id: Id4083a9f07317fc04467e52176850f3909703169

Per [1] and exchange on IRC.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2021-December/026437.html

Change-Id: I322500e7204eb129d7bf085006627e8c4aaaa934

This reverts commit 4ff65b76.

Reason for revert: adds assumptions about inventory_hostname being resolvable.

Closes-Bug: #1955563
Change-Id: Ifa2b2ea8622f56c34b8f7f37fee53133272ff925

Bifrost in Yoga will change the default TFTP and HTTP boot directories
to reside under /var/lib/ironic/. We already avoid the cross-filesystem
linking issue that the patch aims to address, by overriding
tftp_master_path. Avoid this breaking us by reverting to the previous
defaults.

Needed-By: https://review.opendev.org/c/openstack/bifrost/+/822743

Change-Id: Idc54c78c618ae90b4d933c2c401bb1789b0abd36

Change-Id: I67995073b92d6ea9ccc208ae96e8a6045369b801

Fix configuration for ironic role in order to apply custom
policies for ironic-inspector API

Closes-Bug: #1952948
Change-Id: Id454c693f570e99ea58d2a6231f01a84b80ca56a

This variable is referenced by horizon_listen_port, which becomes
undefined outside of the horizon role. One symptom of this is that
the hostvars variable becomes undefined when referenced for debugging
purposes.

This issue was introduced by Ibb5ad1a5d1bbc74bcb62610d77852d8124c4a323,
which has been backported to Victoria.

This change fixes the issue by moving horizon_enable_tls_backend to
group_vars.

TrivialFix

Change-Id: I1fc4e2a24fe096a49434d7e16851e63efd25d74c