Add custom configuration for grafana

Change-Id: I03e3ab57ce538c0f86d1442c7bd30d3ce9012637

Change-Id: Ie9a9adefafd6fae83f45e5f7bdbce9aaa467435f

1.Fix the invalid value about selinux policy
2.Update description of task about selinux.The permissive mode
need enable selinux.The parameter named "disable_selinux" is not good.
In order to customize selinux modes, we need a new
parameter named "selinux_state".

Closes-Bug: #1749046
Change-Id: I20c084cf2e46cc0de149afbd34c6dcb77a1051f4

Apply Cinder database migration procedure:

[1] https://docs.openstack.org/cinder/pike/upgrade.html

Depends-On: I9a847b0a916a85d8f2622e93734330da5122f0d8
Change-Id: I934c38cb5366f0b3a65115b4cdd19878efec7ebc

Agent is required for Neutron SRIOV post Mitaka
Closes-Bug: #1655921

Addressed comments
Added release notes

Change-Id: Ib8181c4da65fccd0c5f8487217060e5682977665
Signed-off-by: Christopher Nipper <christopher.r.nipper@intel.com>

This change allows the following use cases:

1. Using an already-configured MariaDB / MySQL server / Cluster
2. Using already-created DB users, without requiring root DB access.

Update: added external mariadb precheck

Change-Id: I78b0d178306d7c5293b0bf53e445f19f18b4b824
Implements: blueprint external-mariadb-support.
Closes-Bug: #1603121

Change-Id: Ia909c62158acbec9d1dd926d45c66ac36e6b4244
Depends-On: I06325d4601128a0b5a2235370fa44012427c29e3
Implements: blueprint ceph-nfs-ganesha

Depends-On: I5bf14a668a9e8976a18aa28a5bbfe586690bbd31
Implements: blueprint manila-cephfs-backend

Change-Id: I483be398d929429e35e460b5a7660b82f409b587

Implements: blueprint cephfs
Change-Id: I5bf14a668a9e8976a18aa28a5bbfe586690bbd31

Fixes a bug where the Baremetal Introspection service's public endpoint
registered in the Identity service referenced the internal API endpoint.

Also updates keystone endpoints for the Baremetal and Baremetal
Introspection services during reconfigure and upgrade operations.
Previously this was only done during deploy.

Change-Id: I32d475f288bb4a3834c13cc86f0c53b5437c3d25
Closes-Bug: #1738418

Add ansible role to deploy blazar
Add nova filters to allow use of blazar

Change-Id: I6742ddc9a4736f256491dd0cfd31904fa8eb5652
Implements: blueprint blazar-ansible-role

Using Docker volumes for persistent data in the bifrost container is
necessary for upgrading the bifrost services.

This change adds the following volumes:

* bifrost_httpboot
* bifrost_ironic
* bifrost_mariadb
* bifrost_rabbitmq
* bifrost_tftpboot

Ironic creates hardlinks between the TFTP master image store and the
HTTP root path when iPXE is enabled. With different Docker volumes
used for these locations we run into
https://bugs.launchpad.net/ironic/+bug/1507894 during deployment. If
we use a directory under /httpboot to store the master images this
issue is avoided.

Change-Id: I8653268d3598e7a59d2eb45c8750d45b6fc9e35f
Partially-implements: blueprint bifrost-upgrade

Using a kolla_logs volume ensures that logs are persistent beyond the
lifespan of the bifrost_deploy container. This is necessary to support
upgrading the bifrost services. It also opens the possibility of log
forwarding, although we do not currently deploy a fluentd container on
the bifrost host.

Change-Id: If3118cd75ccc87b0d003d5f382695aeaa43ed0f8
Partially-implements: blueprint bifrost-upgrade

Kolla-ansible typically configures services to access the internal API
endpoint of other services, rather than the default public endpoint.

This change ensures that this is the case for ironic inspector.

Change-Id: I998f12435fc1bd306444f9a68bd7f99f5b78f6f8
Closes-Bug: #1740591

Co-Authored-By: caoyuan <cao.yuan@99cloud.net>
Co-Authored-By: Eduardo Gonzalez <dabarren@gmail.com>

Depends-on I7ffb991adbd05275e331401cd73fc84362084ebd
Change-Id: I85afeb5dfce0bf6350a444000bdb885c6fe079c9
Partially-implements: blueprint vitrage-roles

ceph-mgr service is mandatory in ceph luminous

Depends-On: I875f84012a92d4f8b9dcb212d917cf61167270b8
Change-Id: I9418bf40a4bc3dcfc07c8b2eae17cb5779f5b444
Implements: blueprint ceph-luminous

Depends-On: Ia22128e5ce4a717612af658d63258e78e52176ad
Implements: blueprint designate-producer

Change-Id: I98b5e99e8fcfe18fde442b317348ec261f4d2f99

Change-Id: I36d7d62514416104c1f2f36cbd29c26c34c0d20d
Closes-Bug: #1733304

Move Hitachi NAS and Oracle ZFSSA passwords
to /etc/kolla/passwords.yml

Change-Id: I1c94c45701fda5430b5d5a88c719db13d1956b11
Closes-Bug: #1733565

Added ``horizon_keystone_domain_choices`` hash. It can be used to set the
available domains to choose from on the horizon login page. This feature
was introduced in pike release.

Change-Id: Ia7d2bc45e518848a04ce78e7833e1cf9a0ef21ce

In some scenarios it may be useful to apply custom filters to logs
before forwarding them.  This may be useful to add additional tags to
the messages or to modify the tags to conform to a log format that
differs from the one defined by kolla-ansible.

Configuration of custom fluentd filters is possible by placing filter
configuration files in ``/etc/kolla/config/fluentd/filter/*.conf`` on
the ansible control host.

Change-Id: I29a20efb0df4bf3564ef009616c786e928aa26d9
Implements: blueprint fluentd-custom-filters

This commit separates the messaging rpc and notify transports in order
to support separate and different oslo.messaging backends

This patch:
* add rpc and notify variables
* update service role conf templates
* add example to globals.yaml
* add release note

Implements: blueprint hybrid-messaging
Change-Id: I34691c2895c8563f1f322f0850ecff98d11b5185

This patch introduces inner-compute and external-compute nodes
group to distinguish compute nodes which do not have external
reachability from compute nodes which can reach outside.

Co-Authored-By: jinke <jin.ke@99cloud.net>
Co-Authored-By: yong sheng gong <gong.yongsheng@99cloud.net>

Change-Id: I45b945f7885e8243b017cf8607cbd7f9827cb6e9
Closes-bug: #1722026

The service listening port of MDNS can be override by dns_interface.
If so, the pool conf use the wrong IP for join mdns service.

Change-Id: I8a3678955ecf5f769da7090fe5dad68e027c102b

Release notes are version independent, so remove version/release
values. We've found that projects now require the service package
to be installed in order to build release notes, and this is entirely
due to the current convention of pulling in the version information.

Release notes should not need installation in order to build, so this
unnecessary version setting needs to be removed.

This is needed for new release notes publishing, see
I56909152975f731a9d2c21b2825b972195e48ee8 and the discussion starting
at
http://lists.openstack.org/pipermail/openstack-dev/2017-November/124480.html
.

Change-Id: I72537ef7a9c56221fb13d11b4fc5aef9c7446601

  1- Expand and migrate database in first keystone node
  2- Upgrade all nodes sequentially along with updation of each node's
     configuration file with latest release version
  3- Last keystone node, contract database

With this patch, there is small downtime when all containers are
restarted. It will be fixed in other patch.

[1] http://docs.openstack.org/developer/keystone/upgrading.html#upgrading-without-downtime



Co-Authored-By: Surya Prakash Singh <surya.singh@nectechnologies.in>
Co-Authored-By: Eduardo Gonzalez <dabarren@gmail.com>
Co-Authored-By: Duong Ha-Quang <duonghq@vn.fujitsu.com>

Partially-Implements: blueprint ks-rolling-upgrade-role

Change-Id: I2159af567c40848840ff5e483e7d1f6de760b435

As an operator I want to be able to monitor the status
of RabbitMQ by collecting metrics such as queue length,
message rates (globally and per channel), and information
about resource usage on the host, such as memory use,
open file descriptors and the state of the cluster. Whilst
it is possible to gather all of this information using
the OpenStack RabbitMQ user configured by Kolla Ansible,
this user has write access to the OpenStack vhost. This
feature adds a monitoring user which has access to all of
the information described above, but does not have write
access. An example of a service which may use the
monitoring user is the RabbitMQ plugin for the Monasca
Agent. As not all users will configure monitoring, by
default the monitoring user is disabled. To create it,
the user should override the rabbitmq_monitoring_user
variable.

Implements: blueprint add-monitoring-user-for-rabbit
Change-Id: Ie895ddc59dda1c38faab6305163d9bed6710ff9d

Add become to only neccesary tasks in roles:
- glance
- heat
- horizon
- keystone
- neutron
- nova
- openvswitch

Gate is also updated to use 'become' feature

Change-Id: I2f3f27306e9f384148e1ad4d54d8da2ebef34d00
Partial-Implements: blueprint ansible-specific-task-become

This allows for skipping tasks which match the provided tags, using
the ansible-playbook argument of the same name.

This can be useful in combination with --tags, to skip reconfiguration
of the common tasks:

kolla-ansible reconfigure --tags nova --skip-tags common

Change-Id: I766552f7ae4099da3d174759f4a609ffe8b4d89f

Change-Id: Ie26c6b392c5ac86c3ec5effa5241ce5cad10fe40

For a deployment behind a firewall/proxy server some additional
environment settings should be passed along, for containers
such as magnum

This commit adds three new properties;
 container_http_proxy
 container_https_proxy
 container_no_proxy

In particular, the user will want to set container_http_proxy
and container_https_proxy properties with the proxy server
details.

Closes-Bug: #1628335
Change-Id: I0950a0467b4b68c38b13875eaf9cd433e64363cf

Added horizon_keystone_multidomain flag. It can be now overriden
in globals.yml. Default set to False.

Change-Id: I6f8f261cf4b9779e57c2443ac219cdddb1731f52

Add config_owner_user and config_owner_group to group_vars/all,
which is user and group of Kolla configuration files in /etc/kolla.

Add become to post-deploy playbook.

Add become to only neccesary tasks in roles:
- certificate
- common
- destroy
- haproxy
- mariadb
- memcached
- rabbitmq

Change-Id: I2aba745a6e3928c52642f64551470fd08cbfd058
Partial-Implements: blueprint ansible-specific-task-become

Added configuration to enable Oracle ZFS Storage Appliance:
https://docs.openstack.org/cinder/pike/configuration/block-storage/drivers/zfssa-iscsi-driver.html

Change-Id: Id5807f0d4567e16a68283cace7e126eddc4dea20
Implements: blueprint zfssa-cinder-support

This change adds vault arguments to kolla-ansible
to allow usage of vault encrypted  files.

Change-Id: I1dbae6e949543585d11c21e67e82f559d343b4ad

kolla designate DNSaaS makes use of containerised bind9 servers
as it's default designate_backend. These can be disabled by
setting designate_backend to "no". default: "bind9"

This commit adds two new properties:
1) designate_backend_external
 which can be enabled by setting it to 'bind9'. default: "no"
and
2) designate_backend_external_bind9_nameservers, which can
 accept a csv list of all the external server addresses.
 (default: "")

The following attributes should either be set:
'internal' (the default)
 designate_backend: "bind9"
 designate_backend_external: "no"
 (designate_backend_external_bind9_nameservers is ignored)
or
 'external'
 designate_backend: "no"
 designate_backend_external: "bind9"
 (designate_backend_external_bind9_nameservers must be populated)

Configuration override files to align with external bind9
dns servers must be supplied manually,
 /etc/kolla/config/designate/rndc.key
 /etc/kolla/config/designate/rndc.conf

Change-Id: I8dbe6fd4fe7820b9143604d89e8399b07e07c3fd

In some scenarios it may be useful to configure custom fluentd outputs
to forward logs to a logging service other than elasticsearch.

This change supports configuration of fluentd outputs by placing
output configuration files in /etc/kolla/config/fluentd/output/*.conf.

Change-Id: I3c0b271d88dbb307ba3a23546e29c72e8baeca55
Implements: blueprint fluentd-custom-outputs

Actually Openstack services configuration can be overriden using many
files:
- /etc/kolla/config/<< service name >>/<< config file >>
- /etc/kolla/config/<< service name >>/<<host>>/<< config file >>
- /etc/kolla/config/global.conf
- /etc/kolla/config/database.conf
- /etc/kolla/config/messaging.conf

Only per-service configuration is actually documented here:
https://github.com/openstack/kolla-ansible/blob/master/doc/advanced-configuration.rst#L164

Allowing to globally modify service configuration can be perform too,
but it can be done in 3 different manners, all not documented:
- /etc/kolla/config/global.conf
- /etc/kolla/config/database.conf
- /etc/kolla/config/messaging.conf

database.conf and messaging.conf seems redundant with global.conf.
In order to simplify codebase it seems logical to remove them.

Documentation has been added for overriding configuration globally and
release note has been added too.

Closes-Bug: #1682479
Change-Id: I5d922dfc0d938173bad34ac64e490b78db1b7e31

Change-Id: I366c2124a778c5b0b22a8fe369d603adad75ebbe

Change-Id: I92fed4875a5a93c46a3e58c62e5df58180d0f0d1