Fix all-in-one Kubernetes VIM installation

The local.conf.kubernetes sample no longer produces a working
deployment on a single node. Three independent problems are fixed
here.

1) K8S_VERSION and CRIO_VERSION were pinned to 1.30.5 while the sample
enables devstack-plugin-container from master. That plugin renders the
kubeadm configuration with apiVersion kubeadm.k8s.io/v1beta4, which
kubeadm treats as experimental and rejects before 1.31, so kubeadm init
fails.

Bump the pins to the following versions, and note the constraints so
they are not lowered or left behind again. CRI-O follows the Kubernetes
release cycle with respect to its minor versions, so its minor version
is kept the same as the one of kubeadm.
- kubeadm 1.34.2
- cri-o 1.34.2
- etcd v3.5.27

2) configure_tacker creates BR_MGMT with ovs-vsctl during post-config,
but devstack starts the OVS services together with the Neutron agents,
which happens in a later phase. On a single node nothing has started
ovsdb-server by then and the call fails without OVS is already started.

It's not happened in the multi-node Zuul job, where br-infra is
pre-created by the multi-node-bridge role and OVS is already running.
Start the OVS services before creating the bridge. The bridge cannot
simply be created in a later phase instead, because the bridge_mappings
entry written next to it refers to BR_MGMT and the Neutron agents need
it to exist when they start.

The management network is a flat network on MGMT_PHYS_NET, but the
samples never give the chassis a mapping for it. configure_tacker writes
bridge_mappings into the ML2 config, which only the openvswitch agent
reads, so under the default Q_AGENT=ovn nothing ends up in
external_ids:ovn-bridge-mappings and VM based VNFs fail to boot with
PortBindingFailed. Set OVN_BRIDGE_MAPPINGS in both all-in-one samples,
which is what devstack feeds to ovn-bridge-mappings.

3) Update the emphasize-lines range in the install guide, which
refers to local.conf.kubernetes by line number.

Change-Id: Ic64ed2e689dc9ae1962056fcf459d5901afd2daa
Signed-off-by: Yasufumi Ogawa <yasufum.o@gmail.com>

devstack/lib/tacker

@@ -261,6 +261,7 @@ function configure_tacker {
         iniset "/$Q_PLUGIN_CONF_FILE" ovs bridge_mappings $PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE,$MGMT_PHYS_NET:$BR_MGMT
 
         echo "Creating bridge"
+        _tacker_ensure_ovsdb_running
         sudo ovs-vsctl --may-exist add-br ${BR_MGMT}
     fi
     if [[ "${USE_BARBICAN}" == "True" ]]; then
@@ -271,6 +272,34 @@ function configure_tacker {
 # Utility Functions
 #------------------
 
+# Makes sure ovsdb-server is up so that ovs-vsctl can be used.
+#
+# BR_MGMT has to exist before the Neutron agents start, because it is what
+# the bridge_mappings entry written by configure_tacker refers to. That puts
+# its creation in the post-config phase, but devstack starts the OVS services
+# together with the agents, which is later. In the multi-node Zuul job this
+# goes unnoticed: br-infra is pre-created by the multi-node-bridge role and
+# OVS is already running by the time devstack starts.
+function _tacker_ensure_ovsdb_running {
+    if sudo ovs-vsctl --timeout=5 show >/dev/null 2>&1; then
+        return 0
+    fi
+
+    # Set by devstack when Q_AGENT is ovn; the names differ when OVS is built
+    # from source. Fall back to the distro service, which covers both daemons.
+    start_service ${OVSDB_SERVER_SERVICE:-openvswitch-switch}
+    start_service ${OVS_VSWITCHD_SERVICE:-openvswitch-switch}
+
+    local i
+    for i in $(seq 1 10); do
+        if sudo ovs-vsctl --timeout=5 show >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 1
+    done
+    die $LINENO "ovsdb-server is not reachable, cannot create ${BR_MGMT}"
+}
+
 # Configures keystone integration for tacker service and agents
 function _tacker_setup_keystone {
     local conf_file=$1

devstack/local.conf.example

@@ -31,6 +31,13 @@ ENABLE_VERBOSE_LOG_LEVEL=True
 Q_PLUGIN=ml2
 Q_AGENT=ovn
 
+# The management network Tacker creates is a flat network on
+# MGMT_PHYS_NET, which needs a chassis level mapping to BR_MGMT. Only
+# OVN_BRIDGE_MAPPINGS reaches ovn-bridge-mappings; the bridge_mappings
+# option in the ML2 config is read by the openvswitch agent alone, so
+# without this VM based VNFs fail to boot with PortBindingFailed.
+OVN_BRIDGE_MAPPINGS=public:br-ex,mgmtphysnet0:br-infra
+
 # Disable security groups
 LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
 

devstack/local.conf.kubernetes

@@ -31,6 +31,13 @@ ENABLE_VERBOSE_LOG_LEVEL=True
 Q_PLUGIN=ml2
 Q_AGENT=ovn
 
+# The management network Tacker creates is a flat network on
+# MGMT_PHYS_NET, which needs a chassis level mapping to BR_MGMT. Only
+# OVN_BRIDGE_MAPPINGS reaches ovn-bridge-mappings; the bridge_mappings
+# option in the ML2 config is read by the openvswitch agent alone, so
+# without this VM based VNFs fail to boot with PortBindingFailed.
+OVN_BRIDGE_MAPPINGS=public:br-ex,mgmtphysnet0:br-infra
+
 # Disable security groups
 LIBVIRT_FIREWALL_DRIVER=nova.virt.firewall.NoopFirewallDriver
 
@@ -56,10 +63,27 @@ KUBERNETES_VIM=True
 
 # It is necessary to specify the patch version
 # because it is the version used when executing "apt-get install" command.
-K8S_VERSION="1.30.5"
+#
+# NOTE: devstack-plugin-container renders the kubeadm configuration with
+# apiVersion kubeadm.k8s.io/v1beta4, which kubeadm treats as experimental
+# and rejects before 1.31. Keep K8S_VERSION at 1.31 or later.
+K8S_VERSION="1.34.2"
 K8S_TOKEN="9agf12.zsu5uh2m4pzt3qba"
 CONTAINER_ENGINE="crio"
-CRIO_VERSION="1.30.5"
+# NOTE: CRI-O follows the Kubernetes release cycle with respect to its
+# minor versions, so keep the minor version of CRIO_VERSION the same as
+# K8S_VERSION.
+CRIO_VERSION="1.34.2"
+
+# The plugin points kubeadm at the etcd deployed by devstack, and kubeadm 1.34
+# refuses an external etcd older than 3.5.24-0. devstack still defaults to
+# 3.5.21, so pin a newer one. Checksums are from the upstream SHA256SUMS of
+# the release.
+ETCD_VERSION=v3.5.27
+ETCD_SHA256_AMD64="0aad9a9e4e0817a021e933f9806a2b2960a62f949ad5a3d6436d8886945cb1bc"
+ETCD_SHA256_ARM64="1277309f540c5a0329c428f95455c9f76d24f768c8d28fd2753e891c379053fa"
+ETCD_SHA256_PPC64="b41d488dcd579e780f49f5bd747e9386e17e1376ffb77bfff061f7944818a678"
+ETCD_SHA256_S390X="c4377ed23fbc666bfc217fa68ff901f9a922644d50a0bae48d684a8432254507"
 
 enable_plugin devstack-plugin-container https://opendev.org/openstack/devstack-plugin-container master
 

doc/source/install/devstack.rst

@@ -154,7 +154,7 @@ So the first step of installing tacker is to clone Devstack and prepare your
 
          .. literalinclude:: ../../../devstack/local.conf.kubernetes
              :language: ini
-             :emphasize-lines: 54-64
+             :emphasize-lines: 61-88
 
 
          .. note::