Commit Graph

90 Commits

Author SHA1 Message Date
Jake Yip
34c82bdb96 Add feature flag for beta drivers
Change-Id: I9d0851e7f0c740f2a23c3ff935a21cff35769a78
2024-02-27 20:34:05 +11:00
Zuul
c2567f202a Merge "Drop k8s_fedora_ironic_v1 driver" 2024-02-21 23:52:53 +00:00
Zuul
70bb9a64a1 Merge "Replace is_ssl_enabled_service" 2024-02-19 16:07:36 +00:00
Michal Nasiadka
fa5aa8f625 Drop k8s_fedora_ironic_v1 driver
Change-Id: Ic7114e5923b74a4202a043388701826b4e47326e
2024-02-05 08:14:56 +00:00
Zuul
f6baa6d1ff Merge "devstack: Install sonobuoy and kubectl" 2024-01-15 22:18:15 +00:00
Takashi Kajinami
3da07be83a Replace is_ssl_enabled_service
It was kept for backword compatibility but now returns the same value
as `is_service_enabled tls_proxy`[1].

[1] f3b2f4c85307b14f115a020f5eaf6c92026b55b4

Change-Id: I245b0ba9a81c934c808c0043a010f1ef82eee703
2023-12-20 20:49:50 +09:00
Jake Yip
4c22c5f2f1 Remove send_cluster_metrics devstack config
The code to for this was removed in Change
Ib9142ab17d562b1d7ccf1409a9e0d934585a094d

Change-Id: Ie75a794aacb720b62631b215c31c3b02729d7692
2023-10-30 11:57:49 +11:00
Michal Nasiadka
1793251293 devstack: Install sonobuoy and kubectl
Change-Id: I26aa7e7065913be987bc5b298809c918977ba753
2023-10-04 09:26:27 +00:00
ricolin
5971243169 Support enables rbac policies new defaults
The Magnum service allow enables policies (RBAC) new defaults and scope by
default. The Default value of config options ``[oslo_policy] enforce_scope``
and ``[oslo_policy] oslo_policy.enforce_new_defaults`` are both to
``False``, but will change to ``True`` in following cycles.

To enable them then modify the below config options value in
``magnum.conf`` file::

  [oslo_policy]
  enforce_new_defaults=True
  enforce_scope=True

reference tc goal for more detail:
https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html

Related blueprint secure-rbac

Change-Id: I249942a355577c4f1ef51b3988f0cc4979959d0b
2023-08-30 00:35:24 +08:00
Tobias Urdin
206a817cf7 devstack: use iniset_rpc_backend
Instead of calling get_transport_url directly.

Change-Id: Id6395be9da2c1074790115eeaf2fbeba0875cb38
2022-09-27 08:51:27 +00:00
Michal Nasiadka
61c7f7b34b devstack: Create only public endpoint
Just like other devstack services - create only public endpoint.

Change-Id: I375cc7fcba3962eed9c342c0476ecc372f064b47
2022-04-19 13:26:46 +00:00
Erik Olof Gunnar Andersson
fd79dd4fa6 Switch to uwsgi and enable named uri
This patch brings Magnum in line with other services
by using uwsgi for the api service and replaces the use
of a custom api port with /container-infra.

- Switch to using uwsgi for functional tests.
- Use /container-infra instead of a custom api port.

Change-Id: Iab5b23b3874a46ccb5c942e64dc167258712bd31
2021-02-03 17:30:40 +00:00
Bharat Kunwar
9fedb8fe43 [ci] Use Fedora CoreOS image for devstack plugin
Story: 2007561
Task: 39478

Depends-on: https://review.opendev.org/#/c/721213/

Change-Id: I05caa60fd0180e20003f876fd439b6f421e50ff3
2020-04-21 19:52:14 +00:00
Ian Wienand
41768e0ae1 Remove --os-url usage
The token end-point --os-url argument was removed in openstackclient
with I1b9fbb96e447889a41b705324725a2ffc8ecfd9f.

The plugin should be running as admin, I think we can remove all the
authentication arguments and just let it do it's thing.

Change-Id: I9b1dbc541c9fd6c0e3a894dd3a5dd9f2011f1e2a
2019-09-20 11:15:03 +10:00
Feilong Wang
703de97cd4 Using Fedora Atomic 29 as default image
Fedora Atomic 27 has end of life for a while, it's time to replace it
with Fedora Atomic 29 now.

Task: 36356
Story: 2006441

Change-Id: Iab131745854b0b908be17bd17c7510cd54dde1f5
2019-08-24 09:37:35 +12:00
Feilong Wang
d8df9d0c36 [fedora-atomic][k8s] Support default Keystone auth policy file
With the new config option `keystone_auth_default_policy`, cloud admin
can set a default keystone auth policy for k8s cluster when the
keystone auth is enabled. As a result, user can use their current
keystone user to access k8s cluster as long as they're assigned
correct roles, and they will get the pre-defined permissions
set by the cloud provider.

The default policy now is based on the v2 format recently introduced
in k8s-keystone-auth which is getting more useful now. For example,
in v1 it doesn't support a policy for user to access resources from
all namespaces but kube-system, but v2 can do that.

NOTE: Now we're using openstackmagnum dockerhub repo until CPO
team fixing their image release issue.

Task: 30069
Story: 1755770

Change-Id: I2425e957bd99edc92482b6f11ca0b1f91fe59ff6
2019-06-11 11:57:15 +12:00
Erik Olof Gunnar Andersson
ba1ca0e499 Removed admin_* from devstack config
The admin_* variables are a relic of the Keystone V2 api and
should no longer be used at all.

It's important to keep the devstack config clean, as it is often
used as a reference for configuring services.

* Removed deprecated admin_user, admin_password and admin_tenant.

Story: 2004272
Task: 27821

Change-Id: I132e670f446e5172dc4f1847be7779645060ca4d
2018-12-20 04:00:07 +00:00
Zuul
b0e114d9d5 Merge "Add support for www_authentication_uri" 2018-11-08 11:52:33 +00:00
Erik Olof Gunnar Andersson
daa7d04951 Cleaned up devstack logging
Switch to systemd logging to take advantage of some of the newer
logging features.

Story: 2004272
Task: 27820

Change-Id: I475bf26e24b3a725f68c7da355807374bf1e189b
2018-11-06 17:16:28 +00:00
Erik Olof Gunnar Andersson
718cb9c9b4 Add support for www_authentication_uri
We do currently not support www_authentication_uri at all, which
is the new standard, as auth_uri has long been deprecated.

* Make sure we support both auth_uri and www_authenticate_uri.
* Switched to www_authenticate_uri for devstack.
* Fixed a bug where a bad exception would be thrown if auth_uri
  was not set.
  
Story: 2004271
Task: 27819

Change-Id: Ibc932d35f3d6ba2ac7ffb6193aa37bd4a3d4422e
2018-11-06 17:13:10 +00:00
Erik Olof Gunnar Andersson
423d186312 Fixing gate failing due to bad AMQP virtual_host
We are currently hitting this error with the gate.
> NOT_ALLOWED - access to vhost 'None' refused for user 'stackrabbit'

This patch fixes this by using the inbuilt devstack construct
to create an appropriate transport_url.

Change-Id: I9aae96094b7bd8bc148ae3e42c118ba160eff8ae
2018-10-16 01:35:40 +00:00
Kirsten G
d9e590bdc6 Cache barbican certs for periodic tasks
Added configuration parameter, temp_cache_dir, to magnum.conf with
default value of "/var/lib/magnum/certificate-cache". This local
directory will hold cached cluster TLS credentials that are generated
during periodic tasks, to reduce load as the number of clusters
increases. If the temp_cache_dir does not exist, the certificates
will be created as tempfiles.

Closes-Bug: #1659545

Change-Id: I8808c4098a7c8d22dbfc841142c9f9c8b976dde1
2018-04-03 06:15:58 +00:00
Zuul
e644a20e81 Merge "Add send_cluster_metrics configuration parameter" 2018-02-07 14:54:33 +00:00
Kirsten G
cf84683940 Add send_cluster_metrics configuration parameter
Added configuration parameter, send_cluster_metrics, to magnum.conf
with default value of True. If set to True, periodic tasks will pull
COE data and send to ceilometer. This parameter can be set to False to
disable periodic collection of data to avoid unnecessary load from the
cluster.

Closes-Bug: #1668330
Related-Bug: #1746510

Change-Id: I9945293e7b2b52731f6e220d0925c1f6ad097caa
2018-02-01 10:34:54 -08:00
Zuul
029242656d Merge "ci: Add redirection from /v2 to /identity/v2" 2018-01-31 13:50:32 +00:00
Spyros Trigazis
674b90548d ci: Add redirection from /v2 to /identity/v2
Until [1] is in kubernetes we need to redirect from /v2 to
/identity/v2 for the cloud provider to work.

[1] https://github.com/gophercloud/gophercloud/pull/423

Change-Id: I5206e75e9528ceb8428c70df67e6ba26d01c4772
2018-01-19 11:21:01 +05:30
Spyros Trigazis
65dfb2009f Add openstack_ca_file configuration option
In the drivers section of magnum.conf add openstack_ca_file.
This file is expected to be a CA Certificate OR CA bundle
which will be passed on every node and it will be installed
on the host's CA bundle.

Update devstack plugin to use the ssl bundle if tls-proxy is
enabled.

Install the CA for drivers:
k8s_coreos_v1
k8s_fedora_atomic_v1
k8s_fedora_ironic_v1
mesos_ubuntu_v1
swarm_fedora_atomic_v1
swarm_fedora_atomic_v2

Add doc in troubleshooting-guide.

Add release notes.

Closes-Bug: #1580704
Partially-Implements: blueprint heat-agent
Change-Id: Id48fbea187da667a5e7334694c3ec17c8e2504db
2018-01-17 14:58:56 +00:00
chenlx
c609524627 Fix: magnum devstack installation with tls-proxy
Fix wrongly used start_tls_proxy function and correctly set api port
when tls-proxy is enabled.

Also remove start_tls_proxy for ec2 which is not required.

Co-Authored-By: yatin <ykarel@redhat.com>
Change-Id: I71b85b5cb018dd790e13aaa1eeefcbb8ac0b3b85
Closes-Bug: #1727613
2017-11-14 10:49:37 +05:30
Hieu LE
c77e0c709a Register default magnum service and stat policies in code
This commit uses the existing policy-in-code module to move all
default policies for magnum service and stat into code. This commit
also adds helpful documentation about each API those policies protect,
which will be generated in sample policy files and completely remove
usage of policy.json file.

Co-authored-By: Dai Dang-Van <daidv@vn.fujitsu.com>
Implements: blueprint policy-in-code

Change-Id: I01a8ce964bf8bd569d4aa4e899cbcd9855281835
2017-10-23 02:57:29 +00:00
Spyros Trigazis
295ef945f6 swarm: Add docker_volume_type label
* add docker_volume_type for the cinder volumes which are
  used for docker storage.
* add default_docker_volume_type configuration option

Related-Bug: #1678153
Change-Id: Ie18096acf24873ef91a904df4f1a84694a2bb644
2017-06-01 16:17:54 +00:00
ecded75c32 Ignore: Try pxe_ipmitool since vbmc is used
k8s-ironic jobs are failing since long, pxe_ssh is deprecated,
so try pxe_ipmitool.

Change-Id: I48ba8ba4d10a616eb7b482e48ed4a83c3d0acf09
2017-05-19 17:15:17 +05:30
Kevin Lefevre
4c241a683f Enable custom keystone endpoint_type in templates
Allow to specify a custom AUTH_URL for the templates in case instances
cannot reach internalURL which is the case in mose deployment.

A new variable in trust section: trustee_keystone_interface which
default to public is introduced.

Change-Id: I2a908c0752387e4ff4ad2b0fdf0c1025a73ce806
Closes-Bug: #1643197
2017-05-01 18:15:58 +02:00
530d225fcd Fix keystone auth_uri and auth_url
Post [1] we cannot use auth_uri/auth_url containing :5000, :35357.

Update keystone auth_uri and auth_url in magnum.conf to connect
with keystone using /identity/v3 and /identity_admin/v3.

[1] https://review.openstack.org/#/c/456344/

Change-Id: I5d69e7454cf8a5e8c92ff23b6c932184d82e8a98

devstack: Allow access to ports 80 and 443

So far, we were allowing access to port 5000 for keystone.
When devstack siwtched to uwsgi we couldn't access keystone
anymore.

Co-Authored-By: Spyros Trigazis <strigazi@gmail.com>
Change-Id: I4d3d482889fd9f6119ceec81757abac9d1251a97
2017-04-27 04:22:55 +00:00
trilliams
3a9e8cfb40 Glance v1 is deprecated and removed in devstack [1]
With this patch we will use glance v2 api's for interacting
with glance.

[1] I7f962a07317cdad917ee896d79e49ee18938d074

Closes-Bug: 1672535

Change-Id: Iedc25b55ad2751e14d3794b1cb80f724f1a735c4
2017-03-14 16:51:08 +05:30
Johannes Grassler
e93d82e8b3 Fix CVE-2016-7404
This commit addresses multiple potential vulnerabilities in
Magnum. It makes the following changes:

* Permissions for /etc/sysconfig/heat-params inside Magnum
  created instances are tightened to 0600 (used to be 0755).
* Certificate retrieval is modified to work without the need
  for a Keystone trust.
* The cluster's Keystone trust id is only passed into
  instances for clusters where that is actually needed. This
  prevents the trustee user from consuming the trust in cases
  where it is not needed.
* The configuration setting trust/cluster_user_trust (False by
  default) is introduced. It needs to be explicitely enabled
  by the cloud operator to allow clusters that need the
  trust_id to be passed into instances to work. Without this
  setting, attempts to create such clusters will fail.

Please note, that none of these changes apply to existing
clusters. They will have to be deleted and rebuilt to benefit
from these changes.

Change-Id: I643d408cde0d6e30812cf6429fb7118184793400
2017-02-09 16:44:27 +01:00
yatin
7e59f53b59 [devstack] Copy bash_completion script during magnum installation
Copy magnum.bash_completion script to /etc/bash_completion.d
so that users/developers can take advantage of auto completion
of magnum commands.

Change-Id: I8d0ba953e7eb963be1d9e459c4015e882231e2c8
Closes-Bug: #1657004
2017-01-17 11:38:39 +05:30
yatin
9335b17c72 Remove KEYSTONE_CATALOG_BACKEND from magnum plugin
Devstack has removed KEYSTONE_CATALOG_BACKEND from it's
repo: https://review.openstack.org/#/c/391380

Due to above change gate tests are failing, we should
remove it from magnum plugin as well. Refer below for
it's deprecation and removal:-
http://lists.openstack.org/pipermail/openstack-dev/2016-February/086272.html

Change-Id: I9ad6e0577918e811e9dd051b56aa69bfe2c391a0
Closes-Bug: #1644085
2016-11-23 10:54:41 +05:30
yatin
4ffad1d32d Set config param [DEFAULT]/host to hostname
Patch: https://review.openstack.org/#/c/352806 has
set host=None and we don't change this parameter
neither in devstack installation nor in manual installation.
With this patch value of [DEFAULT]/host is set to
hostname of the host on which magnum is setup.
Also, updated manual installation step to set [DEFAULT]/host
to hostname.

Depends-on: I51feb6ccdc0fab91a591568866e6801f2bbb319b
Change-Id: Id43bfcc792b28c98c9bf1d888dd7ddcc167e8ea5
Closes-Bug: #1630190
2016-11-15 08:41:09 +05:30
Mahito OGURA
d8c7a83c9c Change several RabbitMQ config settings
"rabbit_userid", "rabbit_password", "rabbit_host" are deprecated for removal.
This patch changes these options to "transport_url" in DEFAULT group.

Change-Id: I0c33a1f84103d07e371e11229276c8cecdc485c4
Related-Bug: #1451226
2016-09-26 10:50:46 +09:00
rabi
719018e9cb Use heat devstack plugin
Now that heat is available as a devstack plugin, we should
use it. In-tree devstack code for heat is planned to be
removed soon[1].

And also, this patch remove `update_heat_policy` function
in devstack plugin. Because fetching global stack list is
already option to use in Magnum.

[1] https://review.openstack.org/#/c/317618/

Change-Id: Iab675da5ea8d02b3f7e71f6169c81724a0066858
Co-Authored-By: OTSUKA, Yuanying <yuanying@fraction.​jp>
2016-09-15 10:43:09 +09:00
Jenkins
f0c0118c49 Merge "Add functional test for k8s ironic" 2016-08-15 10:39:36 +00:00
yatin
28d8eca8c1 Change stacks:global_index heat policy to context_is_admin
Rule "context_is_admin" is defined in heat for admin role
and heat uses this rule to authorize admin operations.
Since default admin context can be updated by heat, we
should use the rule: context_is_admin.

In newton, heat updated the admin context to admin role
with admin tenant in following patch:-
https://review.openstack.org/#/c/316627/

Change-Id: Iea6f3a6124e0c4d29801641aff51e385f0399488
Closes-Bug: #1499302
2016-08-11 22:36:18 +05:30
OTSUKA, Yuanying
83e0d8d32b Add functional test for k8s ironic
This patch adds functional test for k8s ironic, and modify
utility scripts for gate jobs.

Partial-Implements: blueprint magnum-baremetal-full-support
Change-Id: I8d68711af9d90e4a52901765e7daf97bc2851125
Co-Authored-By: Spyros Trigazis <strigazi@gmail.com>
Co-Authored-By: OTSUKA, Yuanying <yuanying@fraction.jp>
2016-08-09 11:30:04 +02:00
Madhuri Kumari
5f193f2e0e Add x509keypair_cert_manager to store certs in DB
x509keypair_cert_manager stores certs in Magnum DB.

Change-Id: Id8106d7bd5c270679bc189fc0dc17bcbde367d73
Implements: blueprint  blueprint barbican-alternative-store
2016-06-23 09:08:52 +05:30
OTSUKA, Yuanying
1d74849193 Support trustee_domain_name in config file
To setup magnum easier, name based configuration is important.
This patch makes config file support trustee_domain_name and
trustee_domain_admin_name in trust section.
If name and id of trustee domain are provided by user, both
values are passed through into keystone.

Closes-Bug: #1581372
Change-Id: Ia691aca7c29a471f6ba36a1a371ec1edf830b365
2016-06-06 08:23:43 +09:00
Eli Qiao
0b2fefa1a7 devstack: fix magnum service name in is_magnum_enabled
We rename m-api, m-cond to magnum-api, magnum-cond, so need to fix it
in is_magnum_enabled too.

Change-Id: Ifbb290a4b6900636e0964510b4f95d7bc44a84a3
2016-05-27 08:29:32 +08:00
Hongbin Lu
754233c51d Update Magnum service name and description
After this patch [1], Magnum is no longer the "Container Service", it
became the "Container Infrastructure Management Service". This commit
updates the service name and description accordingly:
* Change service name from "container" to "container-infra"
* Update service description to reflect its mission

[1] https://review.openstack.org/#/c/311476/

Depends-On: I55205ff2b304678d2b53bbd4d66403078c6baac8
Closes-Bug: #1584251
Change-Id: I5c271bf3fc4d6ccecaf2918aca28ce946bcc6b22
2016-05-23 15:59:16 -05:00
Hongbin Lu
c52e5bea06 Add tox test for k8s coreos bay
* Add a CoreOS test class TestCoreosKubernetesAPIs
* Add a CoreOS test environment in tox.ini
* Create a base class BaseK8sTest and move OS-agnostic k8s testing
  code to that class.
* Increase the disk size from 8G to 10G for m1.magnum and s1.magnum,
  since CoreOS image requires more disk space to boot.
* Set os-distro property for CoreOS image.

Partial-Bug: #1546101
Change-Id: Ie56a9442ecebe05f39c7669bc950f5a6ca11df33
2016-05-09 02:36:26 +00:00
Jenkins
3025fcc7e9 Merge "devstack: Use magnum-api and magnum-cond for services" 2016-04-19 02:37:53 +00:00
Thomas Bechtold
3fe3e46d4e devstack: Use magnum-api and magnum-cond for services
"m-api" is already used by Manila so switch to "magnum-api"
and "magnum-cond" for devstack.

Change-Id: I0f5e57dd263164652813088fe624f62cda664727
Closes-Bug: #1569879
2016-04-18 10:33:28 +02:00