Commit Graph

28 Commits

Author SHA1 Message Date
Gage Hugo
5ffefb60c1 Remove train and ussuri overrides
We dropped train support a long time ago now, and our latest efforts
are to drop ussuri/bionic images. This change removes any leftover
train overrides as well as any ussuri overrides. This also changes
any image defaults to use wallaby.

Change-Id: I818a3a79faa631ec1b7de625f2113c6f19610760
2022-10-24 16:00:59 -05:00
josebb
52444cf3c8 Support TLS endpoints in barbican
This allows barbican to consume TLS openstack endpoints.
Jobs consume openstack endpoints, typically identity endpoints.
And barbican itself interact with other openstack services via
endpoints.

Change-Id: I890f909fc6466b696ee64aa7dfdd528934fccb2d
2022-09-02 18:30:21 +03:00
josebb
178e4ce313 Support TLS for ks jobs and oslo_db/oslo_message in deployment - barbican
Change-Id: I8bee4e7a075d8431e22941c4b88e31889bb6701c
2022-09-02 18:29:56 +03:00
okozachenko
f3ed56cc18 Use HTTP probe instead of TCP probe
Strictly speaking, open socket doesn't mean working API.
We experienced API stopped responding and the socket was still
open so API was unhealthy actually but kubernetes did not restart.

HTTP probe will fix this issue.

Change-Id: I95bb3ad3123d8a4a784d260477f037fa5506d290
2022-09-01 15:54:07 +10:00
josebb
497f2bbfa8 Distinguish between port number of internal endpoint and binding
port number in barbican

Now binding ports of service and pod spec are configured using
internal endpoint values.
To support reverse proxy for internalUrl, need to distinguish
between binding ports and internal endpoint ports.

I added `service` section in endpoint items apart from admin,public
,internal and default.

Change-Id: I33dbc62338ef8e21fab774e3b91bc474efd6bf36
2022-08-13 12:03:26 +03:00
Brian Haley
ced30abead Support image registries with authentication
Based on spec
support-OCI-image-registry-with-authentication-turned-on.rst

Each Helm chart can configure an OCI image registry and
credentials to use. A Kubernetes secret is then created with this
info. Service Accounts then specify an imagePullSecret specifying
the Secret with creds for the registry. Then any pod using one
of these ServiceAccounts may pull images from an authenticated
container registry.

Related OSH-infra change:
https://review.opendev.org/c/openstack/openstack-helm-infra/+/848142

Change-Id: I54540f14fed29622bc5af8d18939afd06d65e2d8
2022-08-11 00:18:37 +00:00
Gage Hugo
89addfd4e1 Add Xena and Yoga values overrides
This change adds the overrides needed to run both the Xena and
Yoga releases in the OSH zuul jobs.

Change-Id: I65e016a4cb3fd52707ab29c37f025818fcb6c405
2022-06-08 17:21:57 +00:00
Schubert Anselme
8d5ddc9035
Migrate CronJob resources to batch/v1 and PodDisruptionBudget resources to policy/v1
This change updates the following charts to migrate CronJob resources to the batch/v1 API version, available since v1.21. [0]
and to migrate PodDisruptionBudget to the policy/v1 API version, also available since v1.21. [1]

- aodh (CronJob & PodDisruptionBudget)
- barbican (PodDisruptionBudget)
- ceilometer (PodDisruptionBudget)
- cinder (CronJob & PodDisruptionBudget)
- cyborg (PodDisruptionBudget)
- designate (PodDisruptionBudget)
- glance (PodDisruptionBudget)
- heat (CronJob & PodDisruptionBudget)
- horizon (PodDisruptionBudget)
- Ironic (PodDisruptionBudget)
- Keystone (CronJob & PodDisruptionBudget)
- magnum (PodDisruptionBudget)
- masakari (PodDisruptionBudget)
- mistral (PodDisruptionBudget)
- neutron (PodDisruptionBudget)
- nova (CronJob & PodDisruptionBudget)
- octavia (PodDisruptionBudget)
- placement (PodDisruptionBudget)
- rally (PodDisruptionBudget)
- senlin (CronJob & PodDisruptionBudget)

0: https://kubernetes.io/docs/reference/using-api/deprecation-guide/#cronjob-v125
1: https://kubernetes.io/docs/reference/using-api/deprecation-guide/#poddisruptionbudget-v125

Change-Id: I2fc0692e1c8e2c4fa4d4ca1da96b5c6a832343fa
2022-05-19 10:08:18 -04:00
Gage Hugo
a0318c23a4 Remove older values overrides - barbican
This change removes several older values overrides for the barbican
chart as well as bumps the default images used to ussuri.

Change-Id: Id3dd045839147b9f6bb4f4ccb55b229abbadf774
2022-04-26 14:30:26 -05:00
josebb
fd5687ad5f Fix job annotations for db init job in barbican
Change-Id: I190008ff4905b29d27c1984572570a61bb0e1e1e
2022-04-22 21:08:49 +03:00
Thiago Brito
77609e2722 Enable taint toleration for barbican
This changes use the helm-toolkit template for toleration
in openstack services

Signed-off-by: Lucas Cavalcante <lucasmedeiros.cavalcante@windriver.com>
Story: 2009276
Task: 43531
Depends-On: I168837f962465d1c89acc511b7bf4064ac4b546c
Change-Id: I6ca1705cc095613aa9db3375e6f203769694b31f
2022-03-22 18:47:49 +00:00
xuxant02@gmail.com
420dac178e Removed the policy from values in favor of policy in code
As services have the default policy in code, the policy in values files is removed.

Change-Id: Icc07e3915a3b07beb02e8c0845d8d6e18adfcfea
2021-11-11 20:35:06 +05:45
Gage Hugo
c20c1e4400 Update htk requirements repo
As part of the move to helm v3, all the charts in the OSH repos
will no longer lint/build properly due to a lack of helm serve
in helm v3.

This change modifies the helm-toolkit repo location to the
osh-infra repo in order to account for the removal oh helm serve.

This work is part of the migration to helm v3 and will be utilized
in future changes.

Change-Id: I90d25943d69ad6c76455f7778a4894f00c525c46
2021-10-10 18:45:28 -05:00
root
d7524be959 Fix db connection key name in DEFAULT config
Change-Id: I7c31d2f036e7088564fd947e5979dd34c283f768
2021-09-17 17:03:50 +02:00
Haider, Nafiz (nh532m)
040aa3b774 Allow Barbican to talk to TLS'd mariadb
Barbican is NOT tls'ed, this is only for communicating with tls'd mariadb

Change-Id: Ia9598095456f35585eafa68f665d2a763e208571
2021-08-05 16:06:11 +00:00
Andrii Ostapenko
3ac3caa013 Add support for Victoria and Wallaby
Defines compute kit and cinder jobs for new releases with
corresponding values overrides.

Disables compute agent list test for Wallaby since related API
is removed [0].

Since Wallaby with switch of osc to sdk '--id auto' is no longer
treated specially in 'openstack flavor create'. The same behavior
can be achieved w/o specifying --id flag for flavor creation [1].

Starting Wallaby 'nova-manage api_db version' returns init version
for empty database greater than 0 [2]. _db-sync.sh.tpl logic prior to
this commit does not work due to this. We need to either remove
(done in current commit) or justify and alter previous logic.

[0] https://review.opendev.org/749309
[1] https://review.opendev.org/750151
[2] https://opendev.org/openstack/nova/src/branch/stable/wallaby/nova/db/sqlalchemy/migration.py#L32

Change-Id: I361431d9aa8c1a06c5d59f479fb161ecd87e2ee2
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2021-08-02 15:46:07 +00:00
Kabanov, Dmitrii
b1abce9a75 Add Ussuri release support
The PS adds the set of overrides for Ussuri release.

Change-Id: I6b3055e376aa14d0c2ecbea638e6e9ba3b03bde5
2021-06-30 16:47:22 -07:00
Phil Sphicas
ce1b2630d2 Barbican: Add support for master KEK rotation
When using the simple_crypto_plugin (which is enabled by default),
secrets are encrypted with per-project keys, and those keys are
encrypted (or wrapped) with a master key encryption key (KEK, or MKEK).
The wrapped project keys are stored in the database. The KEK is stored
in the barbican configuration file.

If no KEK is specified, a well-known default is used. There is no native
Barbican support for rotating the KEK. Changing the KEK would cause loss
of access to all secrets, because Barbican would be unable to unwrap the
project keys.

This change adds support for upgrading the Helm chart while changing the
KEK. A script can be executed during the db-sync job that decrypts the
project keys with the old KEK, and rewraps them with the new KEK. Note
that no secrets are actually modified during this procedure, and the
project keys are not actually changed.

To use this feature, specify the following values:

    conf:
      barbican:
        simple_crypto_plugin:
          kek: # new KEK, 32-bytes of data, base64-encoded
      simple_crypto_kek_rewrap:
        old_kek: # old KEK, 32-bytes of data, base64-encoded

Change-Id: I462085b89ef80985b42149cccf865e6c5f0f5a53
2021-06-08 07:20:14 +00:00
Phil Sphicas
43f24adf57 Barbican: Add conditional wrapper to helm hook
The pre-install hooks for several of the barbican templates [0] cause
upgrade failures when using helm2. Similar to what was done for keystone
[1], this change wraps them in a conditional that can be toggled off for
anyone still using helm2.

0: https://review.opendev.org/c/openstack/openstack-helm/+/782710
1: https://review.opendev.org/c/openstack/openstack-helm/+/785517

Change-Id: I6a160916ec65d73eef1aaffb510c85ee7fb0d501
2021-06-06 02:52:11 +00:00
Thiago Brito
8ab6013409 Changing all policies to yaml format
In the Victoria cycle oslo.policy decided to change all default policies
to yaml format. Today on openstack-helm we have a mix of json and yaml
on projects and, after having a bad time debugging policies that should
have beeing mounted somewhere but was being mounted elsewhere, I'm
proposing this change so we can unify the delivery method for all
policies across components on yaml (that is supported for quite some
time). This will also avoid having problems in the future as the
services move from json to yaml.

[1] https://specs.openstack.org/openstack/oslo-specs/specs/victoria/policy-json-to-yaml.html

Signed-off-by: Thiago Brito <thiago.brito@windriver.com>
Change-Id: Id170bf184e44fd77cd53929d474582022a5b6d4f
2021-05-26 18:15:41 -03:00
Gage Hugo
5233582991 Remove support for openstack releases older than T
This change bumps each openstack chart version up to the next
greatest minor version of 0.2.0, signifying that openstack-helm
will no longer support older, EOL releases for each chart.

Change-Id: I7ce80c7bdc779c1de4472079f18102f506bfbb90
2021-04-29 12:04:34 -05:00
Susanta Gautam
3abcefea39 Added post-install and post-upgrade hook in jobs for barbican
Chart upgrading was failing due to some immutable fields are needed to upgrade before the jobs can be upgraded. For solving this issue, we
have added the helm.sh/hook annotations with post-install and post-upgrade values.
As for hook-weight annotations, we have added these to control the flow of the jobs with hook creation as the jobs are dependent. Like,
db-init jobs need to run before db-sync and so on.

Change-Id: I2c0f9468371a60d875fd0267b3d916b286f8ce7b
2021-03-24 18:38:37 +05:45
Andrii Ostapenko
20b6b9a236
Change helm-toolkit dependency version to ">= 0.1.0"
Since we introduced chart version check in gates, requirements are not
satisfied with strict check of 0.1.0

Change-Id: If537f69dec7e3360f6bffcc4424f10c248919ece
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>
2020-09-24 12:20:13 -05:00
Mohammed Naser
89969ade3a Add chart-testing linter
Added chart lint in zuul CI to enhance the stability for charts.
Fixed some lint errors in the current charts.

Change-Id: I7e4b191fb9e355ab5d5a233e8ed121346519df62
2020-09-16 21:12:17 +03:00
caoyuan
cb77d3adff Replace git.openstack.org URLs with opendev.org URLs
Change-Id: I9a7bcee8727cb127d57ccb4dce1183895a4130cd
2019-04-25 00:37:57 +08:00
zhulingjie
eb80c4f7f1 Update the home page for openstack project
Change-Id: I3841873915bb6e10e55375cd170688a7d6810535
2018-05-27 14:01:50 -04:00
Michał Dulko
d95bad0b5c Add project mascots as charts icons
OpenStack Foundation started serving project mascots files on
openstack.org. This commit adds URLs to those files as chart icons for
OpenStack projects.

Change-Id: I2482174cd1d9a0f32df91d7d81974a0dc37f5c4d
2017-05-09 14:28:11 +02:00
Tin Lam
a5df950b4b Add barbican chart
This patch set adds barbican chart to OpenStack-Helm.

Implements: bp add-barbican-chart
Change-Id: I46949a9fda74b4dfdb737004dbb5d064104c72e6
2017-05-03 18:40:35 -05:00