cinder_backup_ceph is true in default when enable_ceph is true.

Change-Id: Ic3cbd041a784610323cda4419acb6702f2aa35c1
Closes-Bug: #1699658

Add additional options called 'endpoint_type' for each of config groups
related to nova, cinder and neutron clients.

Change-Id: I24dc11502b148fbe564dc63c6f78b7dcbfe44f01

As describe here:
https://github.com/openstack/cinder/blob/master/cinder/compute/nova.py#L42

* remove 'nova_catalog_info' deprecated option
* add new [nova] section

Change-Id: Ib89a589c8eb8d81839bd4d07d7174b3272136934

Like elasticsearch is already deployed by Kolla-ansible it can be used
to store Graph events.

Closes-Bug: #1697638

Change-Id: I1f33e044d33c21516cb3bf8c6fd5bb0745b843c1

change api.log and registry.log to glance-api.log and glance-registry.log

Closes-bug: #1700718

Change-Id: Ifcde8699fa9537fa06445f79c4bd14b4ee0df32c

Removed code try to install Wily(15.10) kernel in case of Ubuntu
Trusty(14.04).
Last Openstack version supported on Ubuntu 14.04 is Mitaka.
Hence Ubuntu 14.04 related code can be safely remove from Ansible tasks
since Kolla Newton release.

Co-Authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>
Change-Id: Ieca7975a69fb0ba8b49cc522f05e4beca1c2f526

The static contents directory path of the openstack-dashboard
provided by Ubuntu Cloud Archive is different from RDO's.
This fixes the horizon.conf template to set the correct alias
when ubuntu+binary are specified.

Change-Id: I1b0c04cecc66b42bf764aa035e7ec24c37d805e3
Closes-Bug: #1700712

ResellerAdmin role should be created always when Swift is enabled
and not only for Ceilometer. The role is needed for normal users
to get administration rights for their Swift projects and is
required to pass DefCore (OpenStack Powered) certification.

Change-Id: I4faa63b8fae1814e382de2794301248cc0f4a90a
Closes-Bug: #1700729

In case of provider networks we need to configure external bridge
on compute nodes, like it is done in DVR. The only way to tell
if provider networks are to be used is a new flag.

Change-Id: I1aef197ee2b84e28f2131f058e6995551f873fe1
Closes-Bug: #1694726

No handler named "Restart tacker containers", and we should restart
the tacker container according to the context

Change-Id: Idad8843e85eeb536d7abf8332606801f5b6e78ce
Closes-Bug: #1700007

Change-Id: I5744784afc13f2ee884c8dca2b32c982ebebc542
Partially-implements: blueprint sanity-check-container

No handler named "Restart keystone containers", and we should restart
the keystone and the keystone-fernet container according to the context

Closes-Bug: #1699924

Change-Id: I62512dc022426cc762ff603d8554e48651fa621f

Change-Id: Ia766c1aa60d51fbff2c620394474597a7146b9cc
Closes-Bug: #1699658

When you add new nodes to existing cluster, docker will restart
all anyway and that will break a lot, including mariadb.

Change-Id: Ie46f99a141f99480a87218ead4b76ba65f2edae9
Closes-Bug: #1699335

When using the simple_crypto plugin, barbican expects the
[simple_crypto_plugin] kek config value to be a base64-encoded 32 byte
value. However, kolla-ansible is providing a standard autogenerated
password.

There are two relevant variables in kolla-ansible -
barbican_crypto_password (a standard password) and barbican_crypto_key
(a HMAC-SHA256 key). There is no use of barbican_crypto_key other than
when it is generated. barbican_crypto_password is used to set the
[simple_crypto_plugin] kek config value but causes an error when the
simple_crypto plugin is used as the value is not in the expected format.
Using barbican_crypto_key instead resolves the error. Clearly there is a
naming issue here and we should be using barbican_crypto_key instead of
barbican_crypto_password.

This change removes the barbican_crypto_password variable and uses
barbican_crypto_key instead.

Change-Id: I63e2b381c260265e5901ee88ca0a649d96952bda
Closes-Bug: #1699014
Related-Bug: #1683216
Co-Authored-By: Stig Telfer <stig@stackhpc.com>

This patch add configuration options for tenant network types and type
drivers. Both lists are checked so that tenant types are listed in
drivers. For ironic 'flat' driver is mandatory and is added explicitly
into ironic prechecks.

Change-Id: Ie5775001165412910a258cbed2d2ebbb8ebbd879
Closes-Bug: #1694725

Add webconsole support in ironic by pxe_ipmitool driver.
Serial speed must be the same as the serial configuration in
the BIOS settings, so that the operating system boot process
can be seen in the web console.

see:
https://docs.openstack.org/project-install-guide/baremetal/draft/advanced.html#appending-kernel-parameters-to-boot-instances

Change-Id: I967ed2f63a50d024c54e0762ec6c0ae09b66d6bd

Sometimes Ansible is faster running tasks that haproxy tagging Keystone
services as UP. Keystone bootstrap uses SQL directly but the default
user role creation requires the API, and because of that it may fail.

Retry in case the backend is not yet available.

Change-Id: I9dfc030bbf92ca0a3dcb008d55e9fa2055f900ec
Closes-Bug: 1699096

when create database user, it should use
database_user, not database_name.

Change-Id: I4dfa01d1a5a46c5c58f1fc47b0be71b186462764
Closes-Bug: #1698762

Change-Id: I53df90220456f86aedd4018dd54fefa1537f2476

Neutron recommend as good practice to enable port_security
extension by default. Current networks will remain using
security groups, but will allow users to disable port_security
in their port or networks.
An example use case is nfv.

Change-Id: I69f2e3567fd00695cf1c4bcc9177c2b88e33c3ab

Haproxy fails to deploy if outward group is not
in inventory.
This change adds an optional outward setting for
haproxy

Change-Id: I351578582b1057bb48ac69859583a5db13f0bfb8

Facts are retrieved a second time if skydive is enabled.
This patch fix it.

Change-Id: I4fc15daf59b093e4b29ff9f1fc703c8b2a65b238

Condition check are already performed here:
https://github.com/openstack/kolla-ansible/blob/master/ansible/site.yml
In order to simplify codebase, these checks can be removed for
standalone services.

Change-Id: Ib9842cd5363a1c7e56234a5e91dc264f89e2838f

Change-Id: I09654f29b59e0327ee1a7961e0990e4c6927e8fc
Closes-Bug: #1620374

Implement an ansible role that adds Hyper-V as a compute node for
OpenStack using Kolla.

This will install and configure the Nova Compute service, the
Hyper-V Neutron agent and FreeRDP-WebConnect.
https://docs.openstack.org/ocata/config-reference/compute/hypervisor-hyper-v.html



Change-Id: I601835b0769c5ff173a980a05a752391ae8cc82f
Implements: blueprint hyperv-ansible-role
Co-Authored-By: Alessandro Pilotti <apilotti@cloudbasesolutions.com>

Certain services such as Murano and trove require access to a rabbitmq
instance from tenant networks. [0]

Exposing the internal rabbitmq to end users is a security hole, hence
there are two options, 1) use vhosts in the existing rabbitmq, or two a
separate rabbitmq instances. Given the importance of rabbitmq to the
OpenStack deployment, we have decided to go with a separate instance.
Refer to [1] for more detail on the various options.

This change makes the rabbitmq role generic so that it can be reused, in
this case to start 'outward_rabbitmq'. It needs to be exposed via
haproxy both for network isolation and also because this is what Murano
configuration requires.

Follow on patches will be added to add a vhost in this outward instance
for Murano and other services which require access.

Based on the original work by bdaca[2]

[0] http://murano.readthedocs.io/en/stable-liberty/intro/architecture.html
[1] http://lists.openstack.org/pipermail/openstack-dev/2016-December/109091.html
[2] https://review.openstack.org/#/c/374525



Change-Id: Ib2bcc7ed4bf4f883a7cd1dfad3db89201e3cfd8d
Partial-Bug: #1620374
Depends-On: I020eb6219f89a310451becde41f6f1c7f54baadd
Co-Authored-By: Bartłomiej Daca <bartek.daca@gmail.com>

always_run is deprecated and removed in Ansible 2.4
check_mode is introduced in Ansible 2.2 and Kolla-ansible bump Ansible to
2.2.0 so it's safe to replace always_run by check_mode now.

Change-Id: Id1028d38b7bde30a6afe17b319dcdc77907914ab
Closes-Bug: #1643633
Implements: blueprint migrate-to-ansible-2-2-0

Kuryr need etcd on each compute node to store
network data.
Etcd is only deployed in controller nodes at this moment.

Also this change remove and useless bootstrap tasks.

Depends-On: I9c6c876773288c2f951966498db0ff8af090ac20
Change-Id: I8a84334e831fb15f6cbdd3bc34d2159638df6b85
Closes-Bug: #1697699

On many systems IPv6 related modules are not loaded by default.
Usually when one runs ip6tables-* commands required modules are
probed. In neutron_openvswitch_agent container /lib/modules
does not exist. The commands fail to process ip6 firewall
rules as consequence.

Change-Id: Ic4e72eb4f5304f013b7a09ddd31794cfafa67e0b
Closes-Bug: #1615715

Different Y stream version in Ansible is not compatible. Since ansible
2.2.0 is released for a while. It is time for kolla-ansible to bump the
min Ansible version. Then we can remove the annoying WARNING message
in deploying logs and use the new features.

Change-Id: I99f3c5678f6d2d1f93d61c660fbd166184ff6422

Cron is always restarting due dummy environment
variable is None.
This change adds a useless env value.

Change-Id: Iad435bb0671a25bc12c6a6d0d988d555faba76c3
Closes-Bug: #1697706

Zun made mandatory to use kuryr for networking.
This change update zun config to use kuryr.
Also updates documentation.

Change-Id: I9a55e390709b7e21d3efbd4be17a36db85cd8521

Missing config options in kuryr.conf
Missing kuryr logging
Remove useless bootstrap task, justs create a directory
Wrong user permissions in config.json file.
Missing volumes
Missing container capabilities

Depends-On: I4c08a21df263fdefe1fe991cb7ad41cfee65019d
Change-Id: Id4577a78ebf3f1cda5ee36d14e2cc017f38e0f07
Closes-bug: #1697480

keystone-paste.ini file is introduced by
I3a3ca2e74c0ae341105d3481f97956c6da473046 for a security risk of
admin_token_auth middleware. Now this middleware is removed by
I57586ccfa0ad1309cc806d95377dc1ecad015914. So it is safe to use upstream
keystone-paste.ini file.

This patch also keep custom paste file feature. Just put the file to
/etc/kolla/config/keystone/keyston-paste.ini path.

Closes-Bug: #1695023
Partially-Implements: blueprint custom-paste
Change-Id: Ieb983b6a9edb6a156928f6b56a4bd2dbed4281e2

Since whole issue was related to check whether user wants to wipe
device, loopbacks can be opt out from this warnings

Change-Id: Idd823b282e3055457ed041a98c848deb8509cc30
Closes-Bug: #1667074

Change-Id: Idb40cbed763382bef9965c6b090e71156b671590

Solum default use keystone v3
https://github.com/openstack/solum/blob/master/solum/common/solum_keystoneclient.py#L40

Change-Id: I85f73e495ad800f614850cd27fa0e7153dcfc685

Sometimes the "Enable influxdb datasource" task failed with "503 Service
Unavailable" error. Waiting for grafana port UP seems not always enough,
it requires to wait for application ready.

Change-Id: I3a27b3086698b89a80a3f585beb810831289ae7a
Closes-Bug: #1697213

Zun rule number causes conflict with rule 24,
it should be updated to the next free number.

Change-Id: Idbe346bda4ca5dc50f6b5e63818b12af33d532a3