In one of the blazar ansible tasks in "bootstrap.yml", the admin
project name and username are hard-coded as "admin". OpenStack
users can define their admin project name and username differently
and the hard-coded names would cause authentication errors.

In addition, keystone identity api version 3 uses "os-project-name"
instead of "os-tenant-name". Although "os-tenant-name" might be
still accepatable, it's better to keep the latest.

Change-Id: Ie5c1016f9ce6f402ef208f3c295e6883a9edd8ab
Closes-bug: #1853462

- transitional handling of fluentd_binary var is no longer required

Change-Id: Ic2978252fb981fe15e600aa486e8af585d05c402

Change-Id: If45d4877c3fa125a3abc71f0a84883fad0a0cf6e
Closes-Bug: 1853011

Opendaylight support has been deprecated in Train - time to remove it.

Change-Id: I3a61bfbcbf366c327ea3e25d2424bc3fedca29f0

1. Adjust the order of src and dest for template module
2. Remove the double quotes from task's name to keep consistence with
the others.
3. Add a space after "|"

Change-Id: I580517d5b95dcaa34841def70ec6f57a5cbe0229

Continues work from https://review.opendev.org/676716

Change-Id: If0195c38034d404849bf2e8fca4629b2d38a2680
Closes-Bug: #1812864
Related-Bug: #1762754
Related-Bug: #1688331

* Deploy services using kolla-ansible deploy
* Reconfigure the image for one or more services to use an invalid
* config
* Deploy/reconfigure services using kolla-ansible reconfigure

The invalid config could be a wrong docker registry, wrong image name,
wrong tag, etc.

The restart handler for the service fails, and the old container is
left running.

The restart handler for the service fails, and the old container is
stopped and removed. This leaves the service in a broken state.

This change fixes the issue by pulling the image if necessary prior to
stopping and removing the container.

Change-Id: I85b2a1b224d4c4d85c32c4922a2cd2c41171a1dc
Closes-Bug: #1852572

This variable was removed in the Train cycle, and a precheck added for
its use. This precheck can now be removed.

Change-Id: I6d9f0b577631ff9443deecf8ef9d94ca217674c5

Support for deploying neutron-lbaas was removed in the Train release. We
no longer need the task to remove the container in the upgrade process.

Change-Id: Ie336f68c710616de29f34dd4011e137ec056973b

During the Stein release the default storage backend for cloudkitty was
switched to influxdb. To aid this transition we added creation of the
influxdb database during upgrade. Now that this transition is complete
we can remove it.

Change-Id: Ieb247f36af932d3a357504c7419ead44b10d1301

This was deprecated in the Train release in favour of enable_mariadb.

Change-Id: Iea0c6eb51ff26817eeb913c9aa241a9fe7553588

Now that the stable/train branch has been cut, we can set the previous
release to Train. This is done in kolla-ansible for rolling upgrades,
and in CI configuration for upgrade tests.

Change-Id: I9d903543936e59aeeee939b32afce3e63b8c4394

Allow users to create/override HAProxy service configuration by
copying over '*.cfg' files from {{ node_custom_config
}}/haproxy/services.d/

Ex: /etc/kolla/config/haproxy/services.d/radosgw.cfg

Change-Id: Id84e3b6e62e544582d6917047534e846e026798d
Signed-off-by: Keith Plant <kplantjr@gmail.com>

If you do the following:

* Install legacy Docker (1.12.0) using kolla-ansible bootstrap-servers
  with the Rocky release or earlier.
* Update to Docker CE, using kolla-ansible bootstrap-servers with the
  Stein release or later

The package is upgraded, but docker is stopped. This prevents the 'Wait
for Docker to start' task from completing, since Docker will not start.
Seen on CentOS 7.6, Docker CE 19.03.4.

This was tested and working previously, perhaps something changed with
the Docker package.

This change fixes the issue by starting and enabling Docker after the
upgrade.

Change-Id: If6e9c91f3e8d0ec366eea7ca506c6d10dbf11c3a
Closes-Bug: #1852066

After performing a recovery of MariaDB, the mariadb containers are left
without a restart policy. This leaves them unable to recover from the
crash of a single galera node. There is another issue, in that the
'master' node is left in a bootstrap configuration, with the
--wsrep-new-cluster argument configured as BOOTSTRAP_ARGS.

This change fixes these issues by removing the restart policy of 'no'
from the 'slave' containers, and recreating the master container without
the restart policy or bootstrap arguments.

Change-Id: I36c875611931163ca2c29ae93b71d3af64cb197c
Closes-Bug: #1851594

All other roles also use defaults/main.yml.

Change-Id: Ic03aba436a4f3c775ff8e815c93e1d52250d5411

Related: blueprint add-ssl-internal-network
Co-Authored-By: generalfuzz <generalfuzz@gmail.com>

Change-Id: Ib79796d49c415d8314ea5661a16bd2dac8ba7188

In source images, keystone-manage is installed to a virtualenv in
/var/lib/kolla/venv. This is not in the PATH for cron jobs, which always
use PATH=/usr/bin:/bin. This results in the following error:

/usr/bin/fernet-rotate.sh: line 3: keystone-manage: command not found

However this error is not typically visible, since cron logs to syslog
and we do not configure fluentd to collect these logs.

This change configures the PATH in the fernet-rotate.sh script for
source images.

Change-Id: Ib49ea586d36ae32d01b9610a48b13798db4a4cd5
Closes-Bug: #1850711

Change-Id: I49b24545501085d5a44f4de73f0c6dd21e06e2a0
Closes-Bug: #1835501

When supported_policy_files gets set under python 3.7 [1], the regex '(.*)'
matches twice, once for the policy file name and once more for the empty string
that follows the policy file name. This is new behavior under python
3.7. [2]

This leads to the replacement string being written out twice resulting
in something like this: "nova_policy.yamlnova_".

This patch changes the regex to '(.+)' ensuring there is no match success
against the empty string.

[1]:
- set_fact:
    supported_policy_files: "{{ supported_policy_format_list | map('regex_replace', '(.*)', '{{ project_name }}_\\1') | list }}"

[2]: https://docs.python.org/3/library/re.html#re.sub

Change-Id: Ie5278832e293364c66d53ddb07dff9c5409f0cc6
Closes-Bug: 1851249

Change-Id: I12fa6ae8dcec79485c30c4fea2977875aa8f4fae
Closes-Bug: #1850792

Currently, Xtrabackup is used for database backups. However, Xtrabackup
is not compatible with MariaDB 10.3. This change switches to use
mariabackup [1], which is available in the mariadb image.

The documented full and incremental restore procedures have been
modified to use mariabackup, following [2] and [3].

[1] https://mariadb.com/kb/en/library/mariabackup-overview/
[2] https://mariadb.com/kb/en/library/full-backup-and-restore-with-mariabackup/
[3] https://mariadb.com/kb/en/library/incremental-backup-and-restore-with-mariabackup/

Change-Id: Id52b9b1f7b013277e401b1f6b8aed34473d2b2c4
Closes-Bug: #1843043
Depends-On: https://review.opendev.org/691290

We use the wsrep_notify.sh script to notify changes in Galera cluster
membership to haproxy. When xtrabackup was used for the state transfer,
nodes in the Donor state would be included in the backend pool. However,
since the switch to mariabackup in the Stein cycle, we now remove nodes
in the Donor state from the backend pool.

This change ensures that nodes in the Donor state are included in the
backend pool when the SST method is either xtrabackup or mariabackup.

https://galeracluster.com/library/documentation/mysql-wsrep-options.html#wsrep-notify-cmd



Change-Id: Ide4301779a0d221ae5d4dbdd4873fb8a40eb7297
Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Closes-Bug: #1850945

If "reclaim_instance_interval" has been set in nova conf,
attched volume may not be delete while instacne deleted.
Adding cinder auth in nova conf can solve the problem.

Change-Id: I9eb3a74c2f6976043cc35a94915f1fcecb9ef601
Closes-Bug:  1850279

The version_compare filter was renamed to version and changed to be a
test in 2.5. The old filter was removed in 2.9.

TrivialFix

Change-Id: Ib5d91b5fc53d0f6d16dd6eb38121cd9914e33d93

If ironic inspector starts up before ironic-api is accessible, we see
the following error:

AttributeError: StrictVersion instance has no attribute 'version'

This actually prevents startup of ironic inspector.

Example: http://paste.openstack.org/show/756342/

The underlying issue is in python-ironicclient:
https://storyboard.openstack.org/#!/story/2006393.

The workaround employed here is to wait for ironic-api to become
available before starting ironic-inspector.

Change-Id: I674982eba5082fdc951cdcb8247d706278c64c1a
Closes-Bug: #1839866

The MariaDB handlers require master_host to be set.

TrivialFix

Change-Id: I162efbd9e615b86dcdc6e8a4af081cda2f8b0b2b

Due to a Docker bug [1] we cannot use Docker to send
SIGHUP to the container because it will mark it as
stopped.
This patch sends the signal directly to the process,
bypassing Docker.

'changed_when: false' is also removed from the
relevant task as it definitely changes the state.
In the future we could do the refresh only if
there really is a need for another one.

[1] https://github.com/moby/moby/issues/11065



Change-Id: Ief73bbd24568d6941384ea3330ab45f11aa42d37
Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Closes-Bug: #1845244

Adds rabbitmq_server_additional_erl_args variable which
is appended to RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS
environment variable to RabbitMQ server startup script.

This can be used to configure the schedulers.

Docs attached.

Change-Id: Id683c8cc6dac61354ffd94f3b460335b42136ba2
Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Related-bug: #1846467

Change-Id: Ie594f6cdbe332d64d3461d84da730111d0db5cf1
Related-Bug: #1844752

If docker_storage_driver is set in globals.yml, then kolla-ansible
bootstrap-servers is run, it fails like so:

The conditional check 'docker_storage_driver' failed. The error was: error
while evaluating conditional (docker_storage_driver): 'devicemapper' is
undefined

Ansible does not like evaluating strings as conditionals. This change switches
to using the length filter.

Change-Id: Ib95cbdac2a659e7a0d5f113fe48046de3a39dcda
Closes-Bug: #1849691

Change-Id: I51144d92f34ed51c499a4119c059e6475d02eb46

Both swift.conf and proxy-server.conf are affected be
/etc/kolla/config/swift/proxy-server.conf. However, some options in
proxy-server.conf are not valid in swift.conf.

This change keeps this path for proxy-server.conf, but modifies the path
for swift.conf to /etc/kolla/config/swift/proxy-server/swift.conf. The
same applies for other services, object-*, account-*, container-*.

Change-Id: I600891a15244ce705861f6ec93eec1d5ba83c1b8
Closes-Bug: #1849265

Fixes /dev volume, missed in the previous commit [1].
iscsid was installing the devices in /dev but zun-compute
could not see them due to the emulated /dev volume.

[1] I2c4aa666ff9f952e32c450347d31ddbf2e58209e

Change-Id: Ic72c910b92765b9a6f59224728e9c4ea2482bc5a
Related-bug: #1797448
Related-bug: #1848933

If swift_has_replication_network is false some containers do not exist on the
target node.
This commit adds steps to compute the final list of containers to act on.

Change-Id: I12f8de53724c3f24832df83597f36f9614af8e75
Closes-Bug: #1849189

Currently the database is only synced during deployment. This change
performs the sync during upgrade as well.

Change-Id: Ia45fc733a1ab69de9d4762f5d9c8767041eeaed3
Closes-Bug: #1832020

Cephx keys are not picked up by "local_action: shell cat [...]"
when using ansible-vault encrypted keyrings.
This commit changes the logic to use the file lookup plugin and
extracts the key using jinja2 regex filters. The raw keys are then
set as ansible facts.

Closes-Bug: 1849127

Change-Id: Iacb1e42307c4de6a7a379e8cf279e073995fd5d3

See https://bugs.launchpad.net/oslo.rootwrap/+bug/1760471, in particular
comment #1 for an explanation of why inheriting the defaults of the
docker daemon can cause poor performance:

The performance difference likely comes from close_fds=True of subprocess.
Popen. On Python 2, Popen calls close(fd) on all file descriptors from 3 to
SC_OPEN_MAX. On my Fedora 27 "host", SC_OPEN_MAX is 1,024. But in docker,
SC_OPEN_MAX is... 1,048,576: 1,000x larger. On Python 3, Popen is smarter. On
Linux, it lists the content of /proc/self/fd/ to only close open file
descriptors. It doesn't depend on SC_OPEN_MAX value.

Change-Id: Iefef6039644192420abbd3bf614329cbc0d9a62a
Closes-Bug: #1848737
Related-Bug: #1760471
Related-Bug: #1757556
Related-Bug: #1824020

Tacker requires config for storing CSAR vnf packages.
This patch adds it as well as relevant docs.
Only one Tacker Conductor is deployed by default due to
lack of a shared filesystem.

Change-Id: Iad391f35105e79fa9319502256528990915df9b7
Co-authored-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
Closes-Bug: #1845142

This also enables Placement when Zun is enabled like Kolla Ansible
already does with Nova.

Change-Id: Id2a09f702e8503b49d2b9e73e06b2ce9f4d168a9
Closes-bug: #1840573