- Dec 08, 2020
-
-
douyali authored
Change-Id: I94005edeb95282619770b3310af8e6c5811bf8d8
-
- Sep 24, 2020
-
-
James Kirsch authored
This patch introduces an optional backend encryption for the Ironic API service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Ironic service. Change-Id: I9edf7545c174ca8839ceaef877bb09f49ef2b451 Partially-Implements: blueprint add-ssl-internal-network
-
- Sep 10, 2020
-
-
Pierre Riteau authored
This reverts commit 316b0496, because ironic-inspector is not ready to use WSGI. It would need to be split into two separate containers, one running ironic-inspector-api-wsgi and another running ironic-inspector-conductor. Change-Id: I7e6c59dc8ad4fdee0cc6d96313fe66bc1d001bf7
-
- Aug 29, 2020
-
-
James Kirsch authored
This patch introduces an optional backend encryption for the Ironic API and Ironic Inspector service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Ironic service. Change-Id: I3e82c8ec112e53f907e89fea0c8c849072dcf957 Partially-Implements: blueprint add-ssl-internal-network Depends-On: https://review.opendev.org/#/c/742776/
-
- Aug 19, 2020
-
-
Rafael Weingärtner authored
The goal for this push request is to normalize the construction and use of internal, external, and admin URLs. While extending Kolla-ansible to enable a more flexible method to manage external URLs, we noticed that the same URL was constructed multiple times in different parts of the code. This can make it difficult for people that want to work with these URLs and create inconsistencies in a large code base with time. Therefore, we are proposing here the use of "single Kolla-ansible variable" per endpoint URL, which facilitates for people that are interested in overriding/extending these URLs. As an example, we extended Kolla-ansible to facilitate the "override" of public (external) URLs with the following standard "<component/serviceName>.<companyBaseUrl>". Therefore, the "NAT/redirect" in the SSL termination system (HAproxy, HTTPD or some other) is done via the service name, and not by the port. This allows operators to easily and automatically create more friendly URL names. To develop this feature, we first applied this patch that we are sending now to the community. We did that to reduce the surface of changes in Kolla-ansible. Another example is the integration of Kolla-ansible and Consul, which we also implemented internally, and also requires URLs changes. Therefore, this PR is essential to reduce code duplicity, and to facility users/developers to work/customize the services URLs. Change-Id: I73d483e01476e779a5155b2e18dd5ea25f514e93 Signed-off-by:
Rafael Weingärtner <rafael@apache.org>
-
- Aug 10, 2020
-
-
Mark Goddard authored
Previously we mounted /etc/timezone if the kolla_base_distro is debian or ubuntu. This would fail prechecks if debian or ubuntu images were deployed on CentOS. While this is not a supported combination, for correctness we should fix the condition to reference the host OS rather than the container OS, since that is where the /etc/timezone file is located. Change-Id: Ifc252ae793e6974356fcdca810b373f362d24ba5 Closes-Bug: #1882553
-
- Apr 09, 2020
-
-
Dincer Celik authored
Some services look for /etc/timezone on Debian/Ubuntu, so we should introduce it to the containers. In addition, added prechecks for /etc/localtime and /etc/timezone. Closes-Bug: #1821592 Change-Id: I9fef14643d1bcc7eee9547eb87fa1fb436d8a6b3
-
- Jan 30, 2020
-
-
Mark Goddard authored
In dev mode currently the python source is mounted under python2.7 site-packages. This change fixes this to use the distro_python_version variable to ensure dev mode works with Python 3 images. Change-Id: Ieae3778a02f1b79023b4f1c20eff27b37f481077 Partially-Implements: blueprint python-3
-
- Jan 10, 2020
-
-
Mark Goddard authored
For the CentOS 7 to 8 transition, we will have a period where both CentOS 7 and 8 images are available. We differentiate these images via a tag - the CentOS 8 images will have a tag of train-centos8 (or master-centos8 temporarily). To achieve this, and maintain backwards compatibility for the openstack_release variable, we introduce a new 'openstack_tag' variable. This variable is based on openstack_release, but has a suffix of 'openstack_tag_suffix', which is empty except on CentOS 8 where it has a value of '-centos8'. Change-Id: I12ce4661afb3c255136cdc1aabe7cbd25560d625 Partially-Implements: blueprint centos-rhel-8
-
- Dec 12, 2019
-
-
Mark Goddard authored
Ironic provides a feature to allow instance images to be served from a local HTTP server [1]. This is the same server used for PXE images with iPXE. This does not work currently because the ironic_ipxe container does not have access to /var/lib/ironic/images (ironic docker volume), where the images are cached. Note that to make use of this feature, the following is required in ironic.conf: [agent] image_download_source = http This change fixes the issue by giving ironic_ipxe container access to the ironic volume. [1] https://docs.openstack.org/ironic/latest/admin/interfaces/deploy.html#deploy-with-custom-http-servers Change-Id: I501d02cfd40fbacea32d551c3912640c5661d821 Closes-Bug: #1856194
-
- Oct 16, 2019
-
-
Radosław Piliszek authored
Introduce kolla_address filter. Introduce put_address_in_context filter. Add AF config to vars. Address contexts: - raw (default): <ADDR> - memcache: inet6:[<ADDR>] - url: [<ADDR>] Other changes: globals.yml - mention just IP in comment prechecks/port_checks (api_intf) - kolla_address handles validation 3x interface conditional (swift configs: replication/storage) 2x interface variable definition with hostname (haproxy listens; api intf) 1x interface variable definition with hostname with bifrost exclusion (baremetal pre-install /etc/hosts; api intf) neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network basic multinode source CI job for IPv6 prechecks for rabbitmq and qdrouterd use proper NSS database now MariaDB Galera Cluster WSREP SST mariabackup workaround (socat and IPv6) Ceph naming workaround in CI TODO: probably needs documenting RabbitMQ IPv6-only proto_dist Ceph ms switch to IPv6 mode Remove neutron-server ml2_type_vxlan/vxlan_group setting as it is not used (let's avoid any confusion) and could break setups without proper multicast routing if it started working (also IPv4-only) haproxy upgrade checks for slaves based on ipv6 addresses TODO: ovs-dpdk grabs ipv4 network address (w/ prefix len / submask) not supported, invalid by default because neutron_external has no address No idea whether ovs-dpdk works at all atm. ml2 for xenapi Xen is not supported too well. This would require working with XenAPI facts. rp_filter setting This would require meddling with ip6tables (there is no sysctl param). By default nothing is dropped. Unlikely we really need it. ironic dnsmasq is configured IPv4-only dnsmasq needs DHCPv6 options and testing in vivo. KNOWN ISSUES (beyond us): One cannot use IPv6 address to reference the image for docker like we currently do, see: https://github.com/moby/moby/issues/39033 (docker_registry; docker API 400 - invalid reference format) workaround: use hostname/FQDN RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4. This is due to old RabbitMQ versions available in images. IPv4 is preferred by default and may fail in the IPv6-only scenario. This should be no problem in real life as IPv6-only is indeed IPv6-only. Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will no longer be relevant as we supply all the necessary config. See: https://github.com/rabbitmq/rabbitmq-server/pull/1982 For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed to work well). Older Ansible versions are known to miss IPv6 addresses in interface facts. This may affect redeploys, reconfigures and upgrades which run after VIP address is assigned. See: https://github.com/ansible/ansible/issues/63227 Bifrost Train does not support IPv6 deployments. See: https://storyboard.openstack.org/#!/story/2006689 Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c Implements: blueprint ipv6-control-plane Signed-off-by:
Radosław Piliszek <radoslaw.piliszek@gmail.com>
-
- Sep 17, 2019
-
-
Mark Goddard authored
Use upstream Ansible modules for registration of services, endpoints, users, projects, roles, and role grants. Change-Id: I7c9138d422cc91c177fd8992347176bb54156b5a
-
- Aug 15, 2019
-
-
Rafael Weingärtner authored
After all of the discussions we had on "https://review.opendev.org/#/c/670626/2", I studied all projects that have an "oslo_messaging" section. Afterwards, I applied the same method that is already used in "oslo_messaging" section in Nova, Cinder, and others. This guarantees that we have a consistent method to enable/disable notifications across projects based on components (e.g. Ceilometer) being enabled or disabled. Here follows the list of components, and the respective changes I did. * Aodh: The section is declared, but it is not used. Therefore, it will be removed in an upcomming PR. * Congress: The section is declared, but it is not used. Therefore, it will be removed in an upcomming PR. * Cinder: It was already properly configured. * Octavia: The section is declared, but it is not used. Therefore, it will be removed in an upcomming PR. * Heat: It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Ceilometer: Ceilometer publishes some messages in the rabbitMQ. However, the default driver is "messagingv2", and not ''(empty) as defined in Oslo; these configurations are defined in ceilometer/publisher/messaging.py. Therefore, we do not need to do anything for the "oslo_messaging_notifications" section in Ceilometer * Tacker: It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Neutron: It was already properly configured. * Nova It was already properly configured. However, we found another issue with its configuration. Kolla-ansible does not configure nova notifications as it should. If 'searchlight' is not installed (enabled) the 'notification_format' should be 'unversioned'. The default is 'both'; so nova will send a notification to the queue versioned_notifications; but that queue has no consumer when 'searchlight' is disabled. In our case, the queue got 511k messages. The huge amount of "stuck" messages made the Rabbitmq cluster unstable. https://bugzilla.redhat.com/show_bug.cgi?id=1478274 https://bugs.launchpad.net/ceilometer/+bug/1665449 * Nova_hyperv: I added the same configurations as in Nova project. * Vitrage It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Searchlight I created a mechanism similar to what we have in AODH, Cinder, Nova, and others. * Ironic I created a mechanism similar to what we have in AODH, Cinder, Nova, and others. * Glance It was already properly configured. * Trove It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Blazar It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Sahara It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Watcher I created a mechanism similar to what we have in AODH, Cinder, Nova, and others. * Barbican I created a mechanism similar to what we have in Cinder, Nova, and others. I also added a configuration to 'keystone_notifications' section. Barbican needs its own queue to capture events from Keystone. Otherwise, it has an impact on Ceilometer and other systems that are connected to the "notifications" default queue. * Keystone Keystone is the system that triggered this work with the discussions that followed on https://review.opendev.org/#/c/670626/2 . After a long discussion, we agreed to apply the same approach that we have in Nova, Cinder and other systems in Keystone. That is what we did. Moreover, we introduce a new topic "barbican_notifications" when barbican is enabled. We also removed the "variable" enable_cadf_notifications, as it is obsolete, and the default in Keystone is CADF. * Mistral: It was hardcoded "noop" as the driver. However, that does not seem a good practice. Instead, I applied the same standard of using the driver and pushing to "notifications" queue if Ceilometer is enabled. * Cyborg: I created a mechanism similar to what we have in AODH, Cinder, Nova, and others. * Murano It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Senlin It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Manila It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Zun The section is declared, but it is not used. Therefore, it will be removed in an upcomming PR. * Designate It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components * Magnum It was already using a similar scheme; I just modified it a little bit to be the same as we have in all other components Closes-Bug: #1838985 Change-Id: I88bdb004814f37c81c9a9c4e5e491fac69f6f202 Signed-off-by:
Rafael Weingärtner <rafael@apache.org>
-
- May 17, 2019
-
-
binhong.hua authored
When integrating 3rd party component into openstack with kolla-ansible, maybe have to mount some extra volumes to container. Change-Id: I69108209320edad4c4ffa37dabadff62d7340939 Implements: blueprint support-extra-volumes
-
- Apr 08, 2019
-
-
Mark Goddard authored
With Docker CE, the daemon sets the default policy of the iptables FORWARD chain to DROP. This causes problems for provisioning bare metal servers when ironic inspector is used with the 'iptables' PXE filter. It's not entirely clear why these two things interact in this way, but switching to the 'dnsmasq' filter works around the issue, and is probably a good move anyway because it is more efficient. We have added a migration task here to flush and remove the ironic-inspector iptables chain since inspector does not do this itself currently. Change-Id: Iceed5a096819203eb2b92466d39575d3adf8e218 Closes-Bug: #1823044
-
- Mar 06, 2019
-
-
Jim Rollenhagen authored
This allows ironic service endpoints to use custom hostnames, and adds the following variables: * ironic_internal_fqdn * ironic_external_fqdn * ironic_inspector_internal_fqdn * ironic_inspector_external_fqdn These default to the old values of kolla_internal_fqdn or kolla_external_fqdn. This also adds ironic_api_listen_port and ironic_inspector_listen_port options, which default to ironic_api_port and ironic_inspector_port for backward compatibility. These options allow the user to differentiate between the port the service listens on, and the port the service is reachable on. This is useful for external load balancers which live on the same host as the service itself. Change-Id: I45b175e85866b4cfecad8451b202a5a27f888a84 Implements: blueprint service-hostnames
-
- Feb 22, 2019
-
-
Mark Goddard authored
Adds a new flag, 'enable_openstack_core', which defaults to 'yes'. Setting this flag to 'no' will disable the core OpenStack services, including Glance, Heat, Horizon, Keystone, Neutron, and Nova. Improves the default configuration of OpenStack Ironic when used in standalone mode. In particular, configures a noauth mode when Keystone is disabled, and allows the iPXE server to be used for provisioning as well as inspection if Neutron is disabled. Documentation for standalone ironic will be updated separately. This patch was developed and tested using Bikolla [1]. [1] https://github.com/markgoddard/bikolla Change-Id: Ic47f5ad81b8126a51e52a445097f7950dba233cd Implements: blueprint standalone-ironic
-
- Nov 20, 2018
-
-
Mark Goddard authored
The dnsmasq PXE filter [1] provides far better scalability than the iptables filter typically used. Inspector manages files in a dhcp-hostsdir directory that is watched by dnsmasq via inotify. Dnsmasq then either whitelists or blacklists MAC addresses based on the contents of these files. This change adds a new variable, ironic_inspector_pxe_filter, that can be used to configure the PXE filter for ironic inspector. Currently supported values are 'iptables' and 'dnsmasq', with 'iptables' being the default for backwards compatibility. [1] https://docs.openstack.org/ironic-inspector/latest/admin/dnsmasq-pxe-filter.html Implements: blueprint ironic-inspector-dnsmasq-pxe-filter Change-Id: I73cae9c33b49972342cf1984372a5c784df5cbc2
-
- Sep 26, 2018
-
-
Adam Harwell authored
Having all services in one giant haproxy file makes altering configuration for a service both painful and dangerous. Each service should be configured with a simple set of variables and rendered with a single unified template. Available are two new templates: * haproxy_single_service_listen.cfg.j2: close to the original style, but only one service per file * haproxy_single_service_split.cfg.j2: using the newer haproxy syntax for separated frontend and backend For now the default will be the single listen block, for ease of transition. Change-Id: I6e237438fbc0aa3c89a3c8bd706a53b74e71904b
-
- Aug 14, 2018
-
-
MinSun authored
Now kolla dev mode only support clone master branch from git, add version tag to support clone dedicated branch. Change-Id: I88de238e5dc7461ba0662a3ecea9a2d80fd0db60
-
- Aug 03, 2018
-
-
Will Szumski authored
This allows you to append additional kernel parameters to the kernel used for inspection. Change-Id: Ibc851145a3ffdaaad526ef999c8f024bd222dd5b
-
- Jul 26, 2018
-
-
Lakshmi Prasanna Goutham Pratapa authored
This commit is to apply resource-constraints to a few more OpenStack services. Commit to apply constraints to the last set of services will be made in the upcoming commit. Depends-on: Icafa54baca24d2de64238222a5677b9d8b90e2aa Change-Id: I39004f54281f97d53dfa4b1dbcf248650ad6f186
-
- Jul 25, 2018
-
-
Mark Goddard authored
This is configured via the ironic_dnsmasq_default_gateway variable, and is not set by default. Change-Id: I4deea65876d0852ba2b48a8cf9bad94f4df2a18d
-
- Jul 17, 2018
-
-
Duong Ha-Quang authored
This patchset apply Ironic rolling upgrade logic [1][2] [1] https://docs.openstack.org/ironic/latest/contributor/rolling-upgrades.html [2] https://docs.openstack.org/ironic/latest/admin/upgrade-guide.html#rolling-upgrades Depends-On: https://review.openstack.org/#/c/575594/ Co-author: Ha Manh Dong <donghm@vn.fujitsu.com> Change-Id: Id68244951dc66d5c3423ef44324bd72058f4ba67 Implements: blueprint apply-service-upgrade-procedure
-
- Jun 04, 2018
-
-
wu.chunyang authored
Allows users to develop on ironic using Kolla. Partially implements: blueprint mount-sources Change-Id: I74540f5bcbf723f097f3dea96dcaf067834c493a
-
- May 25, 2018
-
-
Will Szumski authored
When enable_ironic_ipxe is set in /etc/kolla/globals.yml, the following happens: - a new docker container, ironic_ipxe, is created. This contains an apache webserver used to serve up the boot images - ironic is configured to use ipxe Change-Id: I08fca1864a00afb768494406c49e968920c83ae7 Implements: blueprint ironic-ipxe
-
- May 21, 2018
-
-
Zhangfei Gao authored
By now, ironic-dnsmasq has default bootfile pxelinux.0, which is correct only for x86. Adding ironic_dnsmasq_boot_file parameter to globals.yml to make it configuable. For example: /etc/kolla/globals.yml ironic_dnsmasq_boot_file: "debian-installer/arm64/bootnetaa64.efi" Change-Id: I6eb57702d4dad549ef8c999c1c82e577f316d8d6
-
- Apr 30, 2018
-
-
Paul Bourke authored
When attempting to inspect a node with ironic, it seems at times ironic_dnsmasq fails to process dhcp bootp requests, giving the following error repeating: dnsmasq-dhcp: DHCPDISCOVER(eth0) 52:54:00:ff:15:55 dnsmasq-dhcp: DHCPOFFER(eth0) 192.169.5.100 52:54:00:ff:15:55 dnsmasq-dhcp: ARP-cache injection failed: Operation not permitted Adding NET_ADMIN fixes this. Co-Authored-By:
Mark Goddard <mark@stackhpc.com> Closes-Bug: #1762805 Change-Id: I39acb81801710f849336380d3fde01c70cd8d8ce
-
- Mar 19, 2018
-
-
caoyuan authored
Change-Id: I29f4d999c711f11f2db4e2d68b3ff194f0ab032b Partially-implements: blueprint better-reconfigure Co-Authored-By:
Mark Goddard <mark@stackhpc.com> Co-Authored-By:
wu.chunyang <wu.chunyang@99cloud.net>
-
- Jan 23, 2018
-
-
Alexandru Bogdan Pica authored
This change allows the following use cases: 1. Using an already-configured MariaDB / MySQL server / Cluster 2. Using already-created DB users, without requiring root DB access. Update: added external mariadb precheck Change-Id: I78b0d178306d7c5293b0bf53e445f19f18b4b824 Implements: blueprint external-mariadb-support. Closes-Bug: #1603121
-
- Jan 17, 2018
-
-
caoyuan authored
through the database_address has beed defined in groups_vars/all.yml, we should better use it, this way, if we want to use external database, we just need to redefined in all.yml refer to https://github.com/openstack/kolla-ansible/blob/master/ansible/group_vars/all.yml#L83 Co-Authored-By:
chenqiaomin <chen.qiaomin@99cloud.net> Change-Id: Ie559301451954e16347ceaabf02f594c5c5cbe56
-
- Jan 04, 2018
-
-
Mark Goddard authored
Fixes a bug where the Baremetal Introspection service's public endpoint registered in the Identity service referenced the internal API endpoint. Also updates keystone endpoints for the Baremetal and Baremetal Introspection services during reconfigure and upgrade operations. Previously this was only done during deploy. Change-Id: I32d475f288bb4a3834c13cc86f0c53b5437c3d25 Closes-Bug: #1738418
-
- Jun 21, 2017
-
-
shaofeng_cheng authored
Add webconsole support in ironic by pxe_ipmitool driver. Serial speed must be the same as the serial configuration in the BIOS settings, so that the operating system boot process can be seen in the web console. see: https://docs.openstack.org/project-install-guide/baremetal/draft/advanced.html#appending-kernel-parameters-to-boot-instances Change-Id: I967ed2f63a50d024c54e0762ec6c0ae09b66d6bd
-
- Jun 03, 2017
-
-
Dai Dang Van authored
In case Kolla's users want to deploy with both of binary and source image, we should have a variable install type that define install type for each project. We also add specific image tag for each Openstack project. This commit is implemented for Ironic, Kabor, Keystone project and iscsi as well. Change-Id: I134d840b1c0e24171a32dec0c7daa6dc2e9ecd87 Implements: blueprint mixing-binary-and-source-image
-
- Jan 26, 2017
-
-
Jeffrey Zhang authored
Co-Authored-By:
Mauricio Lima <mauriciolimab@gmail.com> Change-Id: I9a4a6b6523dee4b388513386b7d85d421f2b7b89
-
- Jan 20, 2017
-
-
Mauricio Lima authored
Co-Authored-By:
Jeffrey Zhang <zhang.lei.fly@gmail.com> Depends-On: Id03619b4e26a0a77c2a39e2de21efd13be0e9200 Change-Id: I723345c1b23cb92ad94cefd965f07b94095ebb41 Closes-Bug: #1650345
-
- May 13, 2016
-
-
Waldemar Znoinski authored
This change makes each step of the kolla deployment aware of the port database was configured to listen on. It defaults mariadb_port to database_port. Change-Id: I8e85d5732015afc0a5481cb33e0b629fdfa84a1b Closes-Bug: #1576151 DocImpact
-
- Mar 09, 2016
-
-
Rodolfo Alonso authored
Changed from ironic_admin_endpoint to ironic_public_endpoint. Change-Id: Ie33ef93a15573380ff013c0444510586afa6c914 Closes-Bug: #1555219
-
- Mar 03, 2016
-
-
SamYaple authored
After our switch to keystone-manage bootstrap Horizon is not happy due to v3 not being setup correctly. This patch fixes that This also includes removal of unused variables (transforms them into endpoint url variables) TrivialFix Change-Id: I1e04db8c24049f80e974c063f03068a2ab32a563
-
- Feb 29, 2016
-
-
Allen Gao authored
Closes-Bug: #1551052 Change-Id: Ic226287bbf1f1e8d5cc2e1d80ce2975448b1f95c
-