* Remove docker's cluster-store option. This option was removed from
  the latest version of docker so we removed it.
* Switch kuryr's capability_scope from "global" to "local". The "global"
  scope relies on a cluster store but docker no longer supports it.

Change-Id: Ie62396184552938d099223f9d325a41c9a5067c3

This reverts commit 94a74f58.

Reason for revert: Zun/Kuryr-libnetwork has switched to "local" scope which doesn't require docker 20 anymore. It should work for latest docker version. Related patches:
https://review.opendev.org/c/openstack/zun/+/903884

Change-Id: Ieb545ae5a5917322f599728587c3f04ea8356126

RabbitMQ does not need to be reconfigured when migrating from non-HA
queues to quorum queues.

Change-Id: I69d409732ff8eb7ae736e95f8a5d290efd33fa32

This allows us to continue execution until a certain proportion of hosts
to fail. This can be useful at scale, where failures are common, and
restarting a deployment is time-consuming.

The default max failure percentage is 100, keeping the default
behaviour. A global max failure percentage may be set via
kolla_max_fail_percentage, and individual services may define a max
failure percentage via <service>_max_fail_percentage.

Note that all hosts in the inventory must be reachable for fact
gathering, even those not included in a --limit.

Closes-Bug: #1833737
Change-Id: I808474a75c0f0e8b539dc0421374b06cea44be4f

This implements a global toggle `om_enable_rabbitmq_quorum_queues`
to enable quorum queues for each service in RabbitMQ, similar to
what was done for HA[0].

Quorum Queues are enabled by default.

Quorum queues are more reliable, safer, simpler and faster than
replicated mirrored classic queues[1].

Mirrored classic queues are deprecated and scheduled for removal
in RabbitMQ 4.0[2].

Notice, that we do not need a new policy in the RabbitMQ definitions
template, because their usage is enabled on the client side and can't
be set using a policy[3].

Notice also, that quorum queues are not yet enabled in oslo.messaging
for the usage of reply_ and fanout_ queues (transient queues).
This will change once[4] is merged.

[0]: https://review.opendev.org/c/openstack/kolla-ansible/+/867771
[1]: https://www.rabbitmq.com/quorum-queues.html
[2]: https://blog.rabbitmq.com/posts/2021/08/4.0-deprecation-announcements/
[3]: https://www.rabbitmq.com/quorum-queues.html#declaring
[4]: https://review.opendev.org/c/openstack/oslo.messaging/+/888479



Signed-off-by: Sven Kieske <kieske@osism.tech>
Change-Id: I6c033d460a5c9b93c346e9e47e93b159d3c27830

Just some minor formatting and wording updates

Change-Id: Ia42944512f8d14a1993bd4ae3d09f0f2ab431322

This commit addresses a few shortcomings in the etcd service:
  * Adding or removing etcd nodes required manual intervention.

  * The etcd service would have brief outages during upgrades or
    reconfigures because restarts weren't always serialised.

This makes the etcd service follow a similar pattern to mariadb:
  * There is now a distiction between bootstrapping the cluster
    and adding / removing another member.

  * This more closely follows etcd's upstream bootstrapping
    guidelines.

  * The etcd role now serialises restarts internally so the
    kolla_serial pattern is no longer appropriate (or necessary).

This does not remove the need for manual intervention in all
failure modes: the documentation has been updated to address the
most common issues.

Note that there's repetition in the container specifications: this
is somewhat deliberate. In a future cleanup, it's intended to reduce
the duplication.

Change-Id: I39829ba0c5894f8e549f9b83b416e6db4fafd96f

Since the CI is failing and there are no contributors working on fixing
this, we are deprecating the service.

Also mention other deprecations in the README.

Change-Id: Ifff11645f6b4682810c042a0421d1eb569ab0ede

Introduce keystone_federation_oidc_additional_options variable

Change-Id: I39b9f35dab6f4e3ac2fcb505aabd2589e6e2ca69

Changes name of ansible module kolla_docker to
kolla_container.

Change-Id: I13c676ed0378aa721a21a1300f6054658ad12bc7
Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>

Collections version taken from official Ansible 7 package [1]
and limited to the same major version.

[1]: https://github.com/ansible-community/ansible-build-data/blob/main/7/ansible-7.7.0.yaml

Change-Id: I0f1ea9717397adc2d2c3215d74ec3759f351a57a

This avoids the need to use a proxy, or some other means, to connect to
Prometheus. This is disabled by default and can be enabled by setting
enable_prometheus_server_external to true.

Change-Id: Ia0af044ff436c2a204b357750a16ff49fcdfec45

Add support for automatic provisioning and renewal of HTTPS
certificates via LetsEncrypt.

Spec is available at:
https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https

Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347


Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
Implements: blueprint letsencrypt-https
Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106

Kolla Ansible should deploy Glance and Cinder Backup with
S3 backend support working out-of-the-box.

The S3 backend had been re-introduced in Ussuri after being
deprecated around the Mitaka timeframe, and having some local
object storage options is nice for testing..

Closes-Bug: #1977515
Change-Id: I4ca58382d1ee568bfca2ad108495422163f81260
Co-authored-by: Juan Pablo Suazo <jsuazo@whitestack.com>
Co-authored-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Change-Id: Ic26e5c06990b25572929bad275c0de35fa3552ec
Signed-off-by: chenxing <chason.chan@foxmail.com>

Following Monasca initial removal in [1]

[1]: I6fc7842bcda18e417a3fd21c11e28979a470f1cf

Change-Id: I94d6f102e8da3882f37f3007639b917c49f907a9

* Zun currently has a dependency on a combination of Docker and
  etcd that is no longer installable (or supported) in newer
  distros.
* These components are core dependencies of other systems and
  vendoring them will be very painful.
* Work to update Zun past this is scheduled for the 'C' cycle.
* If Zun regains compatibility, backports to this series will be
  considered.

Change-Id: I6a2a4ffdcaf1c4fab1097e94d5f255ffb9a2947d

This change introduces haproxy_enable_http2 to let operators enable
http/2 on HAProxy frontends when kolla_enable_tls_external is enabled.

Change-Id: I2e00d3e9193a3052d43a228915ea249794490afe
Closes-Bug: #1850924

Closes-Bug: #2036741

Change-Id: Ib448d04e43dff78e344064161beadae917c41206

* When the Debian job got upgraded from Bullseye
  to Bookworm, the non-voting Zun job started failing.
* This is because Debian Bookworm doesn't support the
  required Docker 20 pinning.
* Until Zun gains support for newer dependencies this
  job will keep failing.

Change-Id: I1e1d9ea7c76d1b2f77b09b7948f138b88ef483d2

Up till now the ARA plugin has been pinned to a very old version,
and is no longer functional.

This installs a much newer version of ARA and adds a README file
to guide developers on how to view the sqlite file.

The ARA plugin is installed by default, but not activated. This
is intended to catch a small amount of regressions and
integration failures.

Developers can enable the plugin by adding the string `#ara`
to their commit message. This avoids extra load on the CI.

Change-Id: Id8328e374c9590b1363026fa2b2b24e191183987

Change-Id: I0aff87f0392b43671c6e9fc3fae3cdb0f7ce118a

This command can be invoked with ``kolla-ansible rabbitmq-reset-state``.
This is primarily designed to be used when enabling HA queues[1].

As such, this also updates the RabbitMQ documentation to use this
command.

[1] https://docs.openstack.org/kolla-ansible/latest/reference/message-queues/rabbitmq.html#high-availability

Change-Id: I6ad95a3618fc1a34af56657ef99ef14dc979f17a

Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/892323

Change-Id: I11db700511233aa60229ee65d0cc96e46aafdf90

While this section of the guide does not need to explain every command
available, ``kolla-ansible genconfig`` is a useful command for people
newer to using KA, so it seems worth mentioning in the guide.

Change-Id: I6f58bb395012b701ad349e967fb3d2f16e9373c7

Change-Id: I149bc646d2e5fb1e32be9c94c6a8d75fd92893e1

Under the Glance section of the external Ceph guide, to enable
copy-on-write the config heading should be ``[DEFAULT]``, rather than
``[GLOBAL]``. For reference, see the Glance docs:
https://docs.openstack.org/glance/latest/configuration/glance_api.html#DEFAULT.show_image_direct_url

Closes-Bug: #2017643
Change-Id: I2d77e01637ecae0bd10319eac4bc75340dd6f61f

Use case: exposing single external https frontend and
load balancing services using FQDNs.

Support different ports for internal and external endpoints.

Introduced kolla_url filter to normalize urls like:
- https://magnum.external:443/v1
- http://magnum.external:80/v1



Change-Id: I9fb03fe1cebce5c7198d523e015280c69f139cd0
Co-Authored-By: Jakub Darmach <jakub@stackhpc.com>

Replaces the instance label on prometheus metrics with the inventory
hostname as opposed to the ip address. The ip address is still used as
the target address which means that there is no issue of the hostname
being unresolvable. Can be optionally enabled or set to FQDNs by
changing the prometheus_instance_label variable as mentioned in the
release notes.

Co-Authored-By: Will Szumski <will@stackhpc.com>
Change-Id: I387c9d8f5c01baf6054381834ecf4e554d0fff35

Ansible 2.14.3 introduced a change that broke the method used for
restarting MariaDB and RabbitMQ serially [1][2]. In
I57425680a4cdbf0daeb9b2cc35920f1b933aa4a8 we limited to 2.14.2 to work
around this. Ansible upstream claim this behaviour was unintentional,
and will not fix it.

This change moves to a different approach where we use separate plays
with a 'serial' keyword to execute the restart.

This change also removes the restriction on the maximum supported
version of 2.14.2 on ansible-core - any 2.14 release is now supported.

[1] https://github.com/ansible/ansible/commit/65366f663de7d044f42ae6dd53368fd4c1f88b35
[2] https://github.com/ansible/ansible/issues/80848

Depends-On: https://review.opendev.org/c/openstack/kolla/+/884208

Change-Id: I5a12670d07077d24047aaff57ce8d33ccf7156ff

This patch is adding a feature for an option to copy different
ceph configuration files and corresponding keyrings for cinder,
glance, manila, gnocchi and nova services.

This is especially useful when the deployment uses availability
zones as below example.

  - Individual compute can read/write to individual ceph
    cluster in same AZ.
  - Cinder can write to several ceph clusters in several AZs.
  - Glance can use multistore and upload images to
    several ceph clusters in several AZs at once.

Change-Id: Ie4d8ab5a3df748137835cae1c943b9180cd10eb1

Followup on I34fd1dcb52cffd9d545d10526109772aeebc2393

Change-Id: I3a14f85fbe5be6ae635774c49872e17f5daea805
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>

Where a list item has multiple paragraphs, the additional paragraphs
must be indented by three spaces (i.e. the level of the first paragraph)
to be considered part of the list item.

Change-Id: I34fd1dcb52cffd9d545d10526109772aeebc2393
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

The ``[pci]`` options in the Nova SRIOV documentation are incorrect.
``alias`` is a JSON object but mentioned as a list of object here.
``through_whitelist`` is deprecated [1] in favour of ``device_spec``.

[1] https://docs.openstack.org/nova/2023.1/configuration/config.html#id116

Closes-Bug: #2019985
Change-Id: I4f9bce297bc3385f9749e4221f4721c1841700a1

Depends-On: https://review.opendev.org/c/openstack/neutron/+/878535
Change-Id: I05d8b29b59a7de76da488f68775547a8f0f11d0f

We limit to 2.14.2 due to a regression in ansible-core [1] that breaks
conditional include_task loops in handlers. This is used for controlled
restarts of MariaDB and RabbitMQ.

[1]: https://github.com/ansible/ansible/commit/65366f663de7d044f42ae6dd53368fd4c1f88b35



Change-Id: I57425680a4cdbf0daeb9b2cc35920f1b933aa4a8
Co-Authored-By: Michal Nasiadka <michal@stackhpc.com>

The section just after this one says the exact same thing with more details, so
we can remove it.

Change-Id: Iaa6c5a092b471728eec6f89d05546091aa4b17d9

Adds a flag ``kolla-ansible octavia-certificates --check-expiry <days>``
to the ``octavia-certificates`` command to check if the certificates
will expire within a given number of days.

Change-Id: I869b8afd85fe282d823ecf3593aa22f94a61b2a0

This reverts commit 9867060b.

Reason for revert: seems this broke some jobs

Change-Id: I1ca81214ece403351c0a522ea05bf07802e4c4c0

Currently, the process of enabling RabbitMQ HA with the variable
``om_enable_rabbitmq_high_availbility`` requires some manual steps to
migrate from transient to mirrored queues. In preparation for setting
this variable to ``True`` by default, this adds a precheck that will
fail if a system is currently running non-mirrored queues and
``om_enable_rabbitmq_high_availbility`` is set to ``True``.

Includes a helpful message informing the operator of their choice.
Either follow the manual procedure to migrate the queues described in
the docs, or set ``om_enable_rabbitmq_high_availbility`` to ``False``.

The RabbitMQ HA section of the reference docs is updated to include
these instructions.

Change-Id: Ic5e64998bd01923162204f7bb289cc110187feec