Missing [murano_auth] with auth_uri ending in '/v3' leads to
keystone authentication failures - murano uses old v2 keystone.

Change-Id: I41846ac4fa78da90e02d91e8d1cec7405178f7df
Closes-Bug: #1753480

Add become to only neccesary tasks in roles:

- aodh
- barbican
- bifrost
- ceilometer
- ceph
- chrony
- cinder
- cloudkitty
- collectd
- congress
- designate
- elasticsearch
- etcd
- freezer
- gnocchi
- grafana
- influxdb
- ironic
- iscsi
- karbor
- kibana
- kuryr
- magnum
- manila
- mistral
- mongodb
- multipathd
- murano
- octavia
- panko
- qdrouterd
- rally
- sahara
- searchlight
- senlin
- skydive
- solum
- swift
- swift
- tacker
- telegraf
- tempest
- trove
- vmtp
- watcher
- zun

Change-Id: I6e32d94d4172dd96d09d8609e8a5221ab5586a31
Partial-Implements: blueprint ansible-specific-task-become

Change-Id: Ie6fd05b52592ad48fd7acbd6b7e9a6f48ffd1150

Skydive need to use internal endpoint
for join keystone like other service.

Change-Id: I6fd76a035ab316f21d483a28a25bfb94c9ed6b95
Closes-Bug: #1747401

Remove duplicated [oslo_policy] in magnum.conf.

Change-Id: I69c82e31d7041d7e8f9c31ba1bf54f0906f2a6dc
Closes-Bug: #1754593

Change-Id: Iad449b35c1e947a0187c5cbf8348d6e9e1b3d597
Closes-bug: #1751976

Till now we've been flusing iptables in the gates to allow cross node
communication in the multi node ceph jobs. This raised security
concerns, in particular it exposed memcached to the external net.

This patch uses the infra provided role 'multi-node-firewall' in order
to correctly configure iptables. Thanks to Jeremy Stanley and Jeffrey
for help with this.

Closes-Bug: #1749326
Change-Id: Iafaf1cf1d9b0227b0f869969d0bd52fbde3791a0

This reverts commit 2a4ce0b8.

Change-Id: I52efd29791a230df1ce7e3acde4b7184aec34150

Ansible provide script module to run shell script, The local script at
path will be transferred to the remote node and then executed, so no
need to copy script to remote node and use shell moulde to run it.
this patch optimise it.

Change-Id: If774502b66652f25593cda137cc8a5baefbd9695

Change-Id: Ia9a7b76a9db4a149d9e0df16ac576ecd706df22b

When bootstrap compute hosts for XenAPI, it will generate a facts
file for each compute node. It contains some XenAPI specific variables
for both the compute host and the XenServer where the compute host
run on. This commit is to fetch the facts file into deployment host
and put it under a centralized directory - each compute host will
have a separate sub-dir which is named with its *inventory_hostname*.

In this way, the following tasks can use proper variable from the
proper facts file which exactly belongs to the host they running on.

Change-Id: I68d1a2d098d38c8e6bf4db76cdaf1f0465831822
blueprint: xenserver-support

CVE-2018-1000115

Change-Id: I30acb41f1209c0d07eb58f4feec91bc53146dcea
Closes-Bug: #1753425

Change-Id: I31969667ab86f61d38752954cb0e565ad7e41970
Closes-Bug: #1752760

Change-Id: I8ee8b4198ccf2f79fdc1acc3a303ede18960a2a1

Change-Id: I1f721a3e9ad3d1a937e05f1d0d53c810b9f2ac39

Change-Id: I653e16270aab539edcec6d8622f0a1c06d04b492

The original code assumes that ElasticSearch will be deployed
on the same node as Kibana. This isn't always the case. When
they are not on the same node, Kibana will not be able to
connect to ElasticSearch and deployment will fail on the task:
'kibana : Wait for kibana to register in elasticsearch'.

A second advantage of making this change is that Kibana won't
break if ElasticSearch goes down on the node that it's running on
when there are additional ElasticSearch instances on other nodes.

A disadvantage of this change is that queries from Kibana to
ElasticSearch will no longer be local.

Closes-Bug: 1751817
Change-Id: I02ab2e7b1eb963b33e29c8f649cc9db0d63316f7

use systemd module to reload the docker service, rather than
command

Change-Id: I2e3b2299365701a08de4025d6ad34cb492b33fda
Closes-Bug: #1751690

when Manila use ceph as backend, Manila will pull keyring
from ceph mon node [0], but the site.yml missing it.

[0]: https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/manila/tasks/ceph.yml#L18

Change-Id: If8f0b9f186a27d9a86227cd5e5ce2405bf57749e
Closes-Bug: #1751534