Commit Graph

412 Commits

Author SHA1 Message Date
Mark Goddard
761ea9a333 Support TLS encryption of RabbitMQ client-server traffic
This change adds support for encryption of communication between
OpenStack services and RabbitMQ. Server certificates are supported, but
currently client certificates are not.

The kolla-ansible certificates command has been updated to support
generating certificates for RabbitMQ for development and testing.

RabbitMQ TLS is enabled in the all-in-one source CI jobs, or when
The Zuul 'tls_enabled' variable is true.

Change-Id: I4f1d04150fb2b5af085b762890092f87ae6076b5
Implements: blueprint message-queue-ssl-support
2020-09-17 12:05:44 +01:00
wu.chunyang
3c312a4d9e remove obsolete configurations
remove cluster_interface from project.
update storage_interface docs.and remove
storage_interface_address variable

Change-Id: I3f811db988234f94b5ed0cc9d24233f70784f58d
2020-08-20 00:06:49 +08:00
Zuul
d1e5de2120 Merge "Add Keep Alive Timeout for httpd" 2020-08-13 15:27:39 +00:00
James Kirsch
19b028e660 Add Keep Alive Timeout for httpd
This patch introduces a global keep alive timeout value for services
that leverage httpd + wsgi to handle http/https requests. The default
value is one minute.

Change-Id: Icf7cb0baf86b428a60a7e9bbed642999711865cd
Partially-Implements: blueprint add-ssl-internal-network
2020-08-13 09:52:40 +00:00
wu.chunyang
f66ee6e105 [doc] add ovn plugin into globals.yml file
we support ovn neutron plugin agent, but the comments miss it.

Change-Id: I1ebfd8208172a1db5b10dfd682ac6192c9de99bf
2020-08-13 00:36:27 +08:00
nikparasyr
6033b71d5e Enable glance role to copy extra configuration
Glance role copies glance-image-import.conf
when enabled to allow configuration of
glance interoperable image import. Property
protection can be enabled and file is copied.

Change-Id: I5106675da5228a5d7e630871f0882269603e6571
Closesl-Bug: #1889272
Signed-off-by: nikparasyr <nik.parasyr@protonmail.com>
2020-08-06 18:43:50 +02:00
Radosław Piliszek
e1e8533c89 Drop RDP console variables
These are noop after Hyper-V support was removed.

Change-Id: Ib451b154893e5cedc366aed83c35f48d92c7ab82
2020-07-27 15:38:56 +02:00
Christian Berendt
6eb02245d6 Remove Hyper-V integration
Change-Id: I2e22ec47f644de2f1509a0111c9e1fffe8da0a1a
2020-07-27 10:25:46 +01:00
Zuul
532599520a Merge "Add support for the Neutron service plugin "trunk"" 2020-07-06 12:32:51 +00:00
Zuul
aac4b5a167 Merge "Remove the neutron-fwaas roles since it retired" 2020-07-05 16:02:26 +00:00
Christian Berendt
3ff15a8ee7 Add support for the Neutron service plugin "trunk"
Change-Id: Ia22f286e85be90983ca79291b3a54596bba30d6c
2020-06-29 11:18:03 +02:00
Pierre Riteau
866784c77a Enable ZooKeeper when Storm is enabled
ZooKeeper is a dependency of Apache Storm.

TrivialFix

Change-Id: Icf952be2e0b53f2e82e8ce18a48bcfa100b41cd9
2020-06-24 14:56:33 +02:00
gugug
1c7ca29664 Remove the neutron-fwaas roles since it retired
Depends-On: I561504160e5548c54d1af31821c3366ab34cf0ec
Change-Id: I15e5c0e0a956ee181873cf002229532a15ff959d
Co-Authored-By: jacky06 <zhang.min@99cloud.net>
2020-06-20 12:12:07 +00:00
gugug
f13847a5a2 Remove the congress roles since it has been retired
more info: https://review.opendev.org/#/c/721733/

Depends-On: I561ead226f714d98c8e06e6027715a64c3a8e47e
Depends-On: I21c9ab9820f78cf76adf11c5f0591c60f76372a8
Change-Id: Ic740d090211ee331b374a6dac69dfde466df7200
Co-Authored-By: jacky06 <zhang.min@99cloud.net>
2020-06-20 01:51:03 +00:00
gugug
66ea6e099f Remove mongodb integration
more info: a6c97d7284

Change-Id: I778d472cc7f6ca19852482a3e309d793973d75a6
Co-Authored-By: jacky06 <zhang.min@99cloud.net>
2020-06-19 09:07:23 +08:00
Zuul
e6584532d2 Merge "Remove mongodb supported for panko backend" 2020-06-18 20:09:23 +00:00
Zuul
1e35ef5a26 Merge "Replace internal and external VIP CA with root CA" 2020-06-16 16:01:25 +00:00
James Kirsch
e3cd02eda4 Replace internal and external VIP CA with root CA
Replaced "kolla_external_fqdn_cacert" and "kolla_internal_fqdn_cacert" with
"kolla_admin_openrc_cacert". OS_CACERT is now set to the value of
"kolla_admin_openrc_cacert" in the generated admin-openrc.sh file.

Change-Id: If195d5402579cee9a14b91f63f5fde84eb84cccf
Partially-Implements: blueprint add-ssl-internal-network
Depends-On: https://review.opendev.org/#/c/731344/
2020-06-16 11:46:34 +01:00
gugug
7ae99328c4 Remove mongodb supported for panko backend
more info: a6c97d7284

Change-Id: I44850d6bb77fec33aa93e1b523eadfe0ef9483a8
Co-Authored-By: jacky06 <zhang.min@99cloud.net>
2020-06-15 22:23:09 +08:00
Christian Berendt
60e03d7bf3 Remove XenAPI integration
Change-Id: Iea3f4f3d2e5c6040c1e0bc7bfae8719cc7d8ac55
2020-06-09 13:56:17 +02:00
Zuul
cb156b9235 Merge "Use api_interface as migration_interface default value" 2020-06-04 12:11:23 +00:00
Jeffrey Zhang
4955a9c020 Use api_interface as migration_interface default value
normally, api_interface is treated as internal and security network plane,
use it as default migration_interface is more meaningful.

Change-Id: Ib9f4bcc19147a49dc09bd905dcd06be165a91b5e
2020-06-02 16:09:14 +08:00
Radosław Piliszek
9e69d33c3f Make openstack_release more obvious
This is forwardport of [1].

[1] https://review.opendev.org/730496

Change-Id: I6523b915e0231c28b5cd91f821515f3d47309d66
2020-05-24 10:02:59 +02:00
Hongbin Lu
91678f67af Zun: Add zun-cni-daemon to compute node
Zun has a new component "zun-cni-daemon" which should be
deployed in every compute nodes. It is basically an implementation
of CNI (Container Network Interface) that performs the neutron
port binding.

If users is using the capsule (pod) API, the recommended deployment
option is using "cri" as capsule driver. This is basically to use
a CRI runtime (i.e. CRI plugin for containerd) for supporting
capsules (pods). A CRI runtime needs a CNI plugin which is what
the "zun-cni-daemon" provides.

The configuration is based on the Zun installation guide [1].
It consits of the following steps:
* Configure the containerd daemon in the host. The "zun-compute"
  container will use grpc to communicate with this service.
* Install the "zun-cni" binary at host. The containerd process
  will invoke this binary to call the CNI plugin.
* Run a "zun-cni-daemon" container. The "zun-cni" binary will
  communicate with this container via HTTP.

Relevant patches:
Blueprint: https://blueprints.launchpad.net/zun/+spec/add-support-cri-runtime
Install guide: https://review.opendev.org/#/c/707948/
Devstack plugin: https://review.opendev.org/#/c/705338/
Kolla image: https://review.opendev.org/#/c/708273/

[1] https://docs.openstack.org/zun/latest/install/index.html

Depends-On: https://review.opendev.org/#/c/721044/
Change-Id: I9c361a99b355af27907cf80f5c88d97191193495
2020-04-30 02:22:20 +00:00
Zuul
975db2b2b4 Merge "OVN Support" 2020-04-15 20:51:57 +00:00
Radosław Piliszek
3c234603a9 Fix Designate not to use etcd coordination backend
etcd via tooz does not support group membership required by
Designate coordination.
The best k-a can do is not to configure etcd in Designate.

Change-Id: I2f64f928e730355142ac369d8868cf9f65ca357e
Closes-bug: #1872205
Related-bug: #1840070
2020-04-13 17:33:02 +02:00
Zuul
2d8edc374d Merge "Add support for encrypting backend Keystone HAProxy traffic" 2020-04-09 16:10:50 +00:00
James Kirsch
b475643c11 Add support for encrypting backend Keystone HAProxy traffic
This patch introduces an optional backend encryption for Keystone
service. When used in conjunction with enabling TLS for service API
endpoints, network communcation will be encrypted end to end, from
client through HAProxy to the Keystone service.

Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519
Partially-Implements: blueprint add-ssl-internal-network
2020-04-09 09:22:55 +00:00
Michal Nasiadka
8a0740df97 OVN Support
Implement OVN Ansible role.

Implements: blueprint ovn-controller-neutron-ansible

Depends-On: https://review.opendev.org/713422
Change-Id: Icd425dea85d58db49c838839d8f0b864b4a89a78
2020-04-09 07:40:12 +02:00
Radosław Piliszek
06a6b56f14 Be less confusing about custom Docker registry
Docker registry password is, by default, sourced from
passwords.yml file.

Cleans up globals.yml to make it clearer.
Also follows the "present defaults" behaviour of the other vars.

Change-Id: Icc993e82a6a435f948e3d17e410eb14717cb0e2d
2020-03-28 09:50:39 +01:00
Doug Szumski
505cded29b Support disabling Prometheus server
This is useful to people who manage their Prometheus Server
externally to Kolla Ansible, or want to use the exporters with
another framework such as Monasca.

Change-Id: Ie3f61e2e186c8e77e21a7b53d2bd7d2a27eee18e
2020-03-20 17:18:39 +00:00
Mark Goddard
bab770a88b CentOS 8: Use master image tag by default
While supporting both CentOS 7 and 8, we used the tag 'master-centos8'
for CentOS 8 images. We are now ready to drop CentOS 7 support, and
Kolla is switching to publish CentOS 8 images using the master tag on
the master branch, so we should use this.

Depends-On: https://review.opendev.org/713265

Partially-Implements: blueprint centos-rhel-8

Change-Id: I07d2c285e3214a6dc827a8e8eacf263048ee099b
2020-03-16 15:58:55 +00:00
Christian Berendt
77a1d27938 Remove enable_cadf_notifications variable
The variable enable_cadf_notifications is deprecated and marked
for removal during the U cycle.

Change-Id: I5e4d20d112db2392b55a0788f4d704ab6ca6112f
2020-03-06 13:40:43 +00:00
Christian Berendt
d749b34160 Add deprecation notes to vmware/xenserver/hyperv guides
The support of vmware, xenserver and hyperv was deprecated.

Change-Id: Id06770c2247ce242f1fc2ac7220bbe6c3070598d
2020-03-03 19:05:06 +01:00
Zuul
19671fb3c7 Merge "[gnocchi] Disable statsd daemon by default" 2020-03-02 13:48:26 +00:00
Jason Anderson
5736500030
[gnocchi] Disable statsd daemon by default
This daemon is an additional piece of functionality supported by Gnocchi
and the general pattern in KA is to disable such things unless the user
explicitly wants them. This also helps avoid having to set the
resource_id, user_id, and project_id variables for Gnocchi if you don't
care about this daemon.

Change-Id: I5f14cee4b0bb0d781b1ff53200d11de972d20c82
2020-02-19 15:28:38 -06:00
Michal Nasiadka
ea36bbf1d1 Allow setting additional galera WSREP options
Change-Id: I26206bece95d31c0182e75f2a585c50d6f0fad6f
2020-02-19 10:56:54 +01:00
Michal Nasiadka
ab3151d8f2 Fix swift entries in group_vars/globals.yml
Change-Id: I41c2fb7d476d553aeaca34feef1d045967c284fb
2020-02-13 15:33:13 +01:00
Michal Nasiadka
4e6fe7a6da Remove kolla-ceph
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1].

This change removes the Ansible code and associated CI jobs.

[1]: https://review.opendev.org/669214

Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
2020-02-11 11:42:06 +01:00
James Kirsch
d100904f2c Generate self signed TLS certificates
Generate both internal and external self signed TLS certificates.
Duplicate the certificate if internal and external VIPs are the same.

Change-Id: I16b345c0b29ff13e042eed8798efe644e0ad2c74
Partially-Implements: blueprint custom-cacerts
2020-01-28 14:03:33 -08:00
James Kirsch
511ba9f6a2 Copy CA into containers.
When kolla_copy_ca_into_containers is set to "yes", the Certificate
Authority in /etc/kolla/certificates will be copied into service
containers to enable trust for that CA. This is especially useful when
the CA is self signed, and would not be trusted by default.

Partially-Implements: blueprint custom-cacerts

Change-Id: I4368f8994147580460ebe7533850cf63a419d0b4
2020-01-28 14:03:32 -08:00
Mark Goddard
9755c924be CentOS 8: Support variable image tag suffix
For the CentOS 7 to 8 transition, we will have a period where both
CentOS 7 and 8 images are available. We differentiate these images via a
tag - the CentOS 8 images will have a tag of train-centos8 (or
master-centos8 temporarily).

To achieve this, and maintain backwards compatibility for the
openstack_release variable, we introduce a new 'openstack_tag' variable.
This variable is based on openstack_release, but has a suffix of
'openstack_tag_suffix', which is empty except on CentOS 8 where it has a
value of '-centos8'.

Change-Id: I12ce4661afb3c255136cdc1aabe7cbd25560d625
Partially-Implements: blueprint centos-rhel-8
2020-01-10 09:56:04 +00:00
Zuul
6dde7ce833 Merge "Adds monasca-ui to horizon" 2020-01-08 16:27:10 +00:00
Zuul
326d9e0fa2 Merge "Add internal TLS variables to globals.yml" 2020-01-04 10:29:00 +00:00
Hamed Bahadorzadeh
2eebf64275 Adds monasca-ui to horizon
Variable added to evaluate "ENABLE_MONASCA" env for 'kolla/horizon'. In
case 'enable_horizon_monasca' is true, 'policy_item' would be called for
Monasca.

Change-Id: Ie9ecb8ab5d4e74af9b83a5b00ccced5b630ab1ed
Implements: blueprint monasca-ui
Signed-off-by: Hamed Bahadorzadeh <h.bahadorzadeh@gmail.com>
2019-12-28 15:16:28 +03:30
Zuul
a46292f6b6 Merge "Support configuration of Docker client timeout" 2019-12-10 12:38:57 +00:00
Zuul
558b745ae1 Merge "Support deploying Elasticsearch Curator" 2019-12-10 10:52:46 +00:00
Doug Szumski
d4381456fd Support deploying Elasticsearch Curator
This allows users to supply an Elasticsearch Curator actions file
to manage log retention [1]. Curator then runs on a cron job, which
defaults to every day. A default curator actions file is provided,
which can be customised by the end user if required.

[1] https://www.elastic.co/guide/en/elasticsearch/client/curator/current/actionfile.html

Change-Id: Ide9baea9190ae849e61b9d8b6cff3305bdcdd534
2019-12-09 14:49:05 +00:00
Mark Goddard
01050dc01f Support configuration of Docker client timeout
Adds support for configuration of the Docker client timeout via
'docker_client_timeout'.

This change also increases the default timeout to 120 seconds, as we
sometimes see timeouts in CI and heavily loaded or underpowered
environments. Increasing 'docker_client_timeout' further may be helpful
in cases where Docker reports 'Read timed out'.

Change-Id: I73745771078cb2c0ebae2b1d87ba2c4c12958d82
Closes-Bug: #1809844
2019-11-28 10:10:00 +00:00
Mark Goddard
6c783b74fc Add internal TLS variables to globals.yml
Change-Id: I283ccee11e360020c3e537b2f55a6be02cbdb2dd
Related: blueprint add-ssl-internal-network
2019-11-26 17:52:13 +00:00