aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ansible/group_vars/all/glance.yml1
-rw-r--r--ansible/roles/fluentd/defaults/main.yml6
-rw-r--r--ansible/roles/glance/defaults/main.yml95
-rw-r--r--ansible/roles/glance/tasks/config.yml44
-rw-r--r--ansible/roles/glance/tasks/stop.yml9
-rw-r--r--ansible/roles/glance/tasks/upgrade.yml9
-rw-r--r--ansible/roles/glance/templates/glance-api.conf.j24
-rw-r--r--ansible/roles/glance/templates/glance-api.json.j220
-rw-r--r--ansible/roles/glance/templates/glance-tls-proxy.cfg.j249
-rw-r--r--ansible/roles/glance/templates/glance-tls-proxy.json.j223
-rw-r--r--ansible/roles/loadbalancer/tasks/upgrade.yml9
-rw-r--r--doc/source/admin/advanced-configuration.rst4
-rw-r--r--kolla_ansible/tests/unit/test_filters.py100
-rw-r--r--releasenotes/notes/uwsgi-glance-97f43edefef2112b.yaml7
14 files changed, 78 insertions, 302 deletions
diff --git a/ansible/group_vars/all/glance.yml b/ansible/group_vars/all/glance.yml
index 11273e4f7..285104be7 100644
--- a/ansible/group_vars/all/glance.yml
+++ b/ansible/group_vars/all/glance.yml
@@ -25,4 +25,3 @@ glance_public_endpoint: "{{ glance_external_fqdn | kolla_url(public_protocol, gl
glance_api_port: "9292"
glance_api_listen_port: "{{ glance_api_port }}"
glance_api_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else glance_api_port }}"
-glance_tls_proxy_stats_port: "9293"
diff --git a/ansible/roles/fluentd/defaults/main.yml b/ansible/roles/fluentd/defaults/main.yml
index dfbe2d635..e6ccd915e 100644
--- a/ansible/roles/fluentd/defaults/main.yml
+++ b/ansible/roles/fluentd/defaults/main.yml
@@ -39,7 +39,6 @@ fluentd_image: "{{ docker_image_url }}fluentd"
fluentd_image_full: "{{ fluentd_image }}:{{ fluentd_tag }}"
syslog_haproxy_facility: "local1"
-syslog_glance_tls_proxy_facility: "local2"
syslog_facilities:
- name: "haproxy"
@@ -47,11 +46,6 @@ syslog_facilities:
facility: "{{ syslog_haproxy_facility }}"
logdir: "haproxy"
logfile: "haproxy_latest"
- - name: "glance_tls_proxy"
- enabled: "{{ glance_enable_tls_backend | bool and inventory_hostname in groups['glance-api'] }}"
- facility: "{{ syslog_glance_tls_proxy_facility }}"
- logdir: "glance-tls-proxy"
- logfile: "glance-tls-proxy"
fluentd_default_volumes:
- "{{ node_config_directory }}/fluentd/:{{ container_config_directory }}/:ro"
diff --git a/ansible/roles/glance/defaults/main.yml b/ansible/roles/glance/defaults/main.yml
index 0a7bf641a..d42bec88d 100644
--- a/ansible/roles/glance/defaults/main.yml
+++ b/ansible/roles/glance/defaults/main.yml
@@ -11,9 +11,10 @@ glance_services:
volumes: "{{ glance_api_default_volumes + glance_api_extra_volumes }}"
dimensions: "{{ glance_api_dimensions }}"
healthcheck: "{{ glance_api_healthcheck }}"
+ wsgi: "glance.wsgi.api:application"
haproxy:
glance_api:
- enabled: "{{ enable_glance | bool and not glance_enable_tls_backend | bool }}"
+ enabled: "{{ enable_glance | bool }}"
mode: "http"
external: false
port: "{{ glance_api_port }}"
@@ -23,8 +24,9 @@ glance_services:
- "timeout server {{ haproxy_glance_api_server_timeout }}"
- "option httpchk"
custom_member_list: "{{ haproxy_members.split(';') }}"
+ tls_backend: "{{ glance_enable_tls_backend | bool }}"
glance_api_external:
- enabled: "{{ enable_glance | bool and not glance_enable_tls_backend | bool }}"
+ enabled: "{{ enable_glance | bool }}"
mode: "http"
external: true
external_fqdn: "{{ glance_external_fqdn }}"
@@ -35,41 +37,7 @@ glance_services:
- "timeout server {{ haproxy_glance_api_server_timeout }}"
- "option httpchk"
custom_member_list: "{{ haproxy_members.split(';') }}"
- glance-tls-proxy:
- container_name: glance_tls_proxy
- group: glance-api
- host_in_groups: "{{ inventory_hostname in glance_api_hosts }}"
- enabled: "{{ glance_enable_tls_backend }}"
- image: "{{ glance_tls_proxy_image_full }}"
- volumes: "{{ glance_tls_proxy_default_volumes + glance_tls_proxy_extra_volumes }}"
- dimensions: "{{ glance_tls_proxy_dimensions }}"
- healthcheck: "{{ glance_tls_proxy_healthcheck }}"
- haproxy:
- glance_tls_proxy:
- enabled: "{{ enable_glance | bool and glance_enable_tls_backend | bool }}"
- mode: "http"
- external: false
- port: "{{ glance_api_port }}"
- frontend_http_extra:
- - "timeout client {{ haproxy_glance_api_client_timeout }}"
- backend_http_extra:
- - "timeout server {{ haproxy_glance_api_server_timeout }}"
- - "option httpchk"
- custom_member_list: "{{ haproxy_tls_members.split(';') }}"
- tls_backend: "yes"
- glance_tls_proxy_external:
- enabled: "{{ enable_glance | bool and glance_enable_tls_backend | bool }}"
- mode: "http"
- external: true
- external_fqdn: "{{ glance_external_fqdn }}"
- port: "{{ glance_api_public_port }}"
- frontend_http_extra:
- - "timeout client {{ haproxy_glance_api_client_timeout }}"
- backend_http_extra:
- - "timeout server {{ haproxy_glance_api_server_timeout }}"
- - "option httpchk"
- custom_member_list: "{{ haproxy_tls_members.split(';') }}"
- tls_backend: "yes"
+ tls_backend: "{{ glance_enable_tls_backend | bool }}"
####################
# Config Validate
@@ -87,8 +55,7 @@ glance_config_validation:
####################
# HAProxy
####################
-haproxy_members: "{% for host in glance_api_hosts %}server {{ hostvars[host].ansible_facts.hostname }} {{ 'api' | kolla_address(host) }}:{{ glance_api_listen_port }} check inter 2000 rise 2 fall 5;{% endfor %}"
-haproxy_tls_members: "{% for host in glance_api_hosts %}server {{ hostvars[host].ansible_facts.hostname }} {{ 'api' | kolla_address(host) }}:{{ glance_api_listen_port }} check inter 2000 rise 2 fall 5 ssl verify required ca-file {{ haproxy_backend_cacert }};{% endfor %}"
+haproxy_members: "{% for host in glance_api_hosts %}server {{ hostvars[host].ansible_facts.hostname }} {{ 'api' | kolla_address(host) }}:{{ glance_api_listen_port }} check inter 2000 rise 2 fall 5{% if glance_enable_tls_backend | bool %} ssl verify required ca-file {{ haproxy_backend_cacert }}{% endif %};{% endfor %}"
####################
# Keystone
@@ -164,18 +131,13 @@ glance_api_image: "{{ docker_image_url }}glance-api"
glance_api_tag: "{{ glance_tag }}"
glance_api_image_full: "{{ glance_api_image }}:{{ glance_api_tag }}"
-glance_tls_proxy_image: "{{ docker_image_url }}haproxy"
-glance_tls_proxy_tag: "{{ haproxy_tag }}"
-glance_tls_proxy_image_full: "{{ glance_tls_proxy_image }}:{{ glance_tls_proxy_tag }}"
-
glance_api_dimensions: "{{ default_container_dimensions }}"
-glance_tls_proxy_dimensions: "{{ default_container_dimensions }}"
glance_api_enable_healthchecks: "{{ enable_container_healthchecks }}"
glance_api_healthcheck_interval: "{{ default_container_healthcheck_interval }}"
glance_api_healthcheck_retries: "{{ default_container_healthcheck_retries }}"
glance_api_healthcheck_start_period: "{{ default_container_healthcheck_start_period }}"
-glance_api_healthcheck_test: ["CMD-SHELL", "healthcheck_curl http://{% if glance_enable_tls_backend | bool %}localhost{% else %}{{ api_interface_address | put_address_in_context('url') }}{% endif %}:{{ glance_api_listen_port }}"]
+glance_api_healthcheck_test: ["CMD-SHELL", "healthcheck_curl {{ 'https' if glance_enable_tls_backend | bool else 'http' }}://{{ api_interface_address | put_address_in_context('url') }}:{{ glance_api_listen_port }}"]
glance_api_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}"
glance_api_healthcheck:
interval: "{{ glance_api_healthcheck_interval }}"
@@ -184,19 +146,6 @@ glance_api_healthcheck:
test: "{% if glance_api_enable_healthchecks | bool %}{{ glance_api_healthcheck_test }}{% else %}NONE{% endif %}"
timeout: "{{ glance_api_healthcheck_timeout }}"
-glance_tls_proxy_enable_healthchecks: "{{ enable_container_healthchecks }}"
-glance_tls_proxy_healthcheck_interval: "{{ default_container_healthcheck_interval }}"
-glance_tls_proxy_healthcheck_retries: "{{ default_container_healthcheck_retries }}"
-glance_tls_proxy_healthcheck_start_period: "{{ default_container_healthcheck_start_period }}"
-glance_tls_proxy_healthcheck_test: ["CMD-SHELL", "healthcheck_curl -u {{ haproxy_user }}:{{ haproxy_password }} {{ api_interface_address | put_address_in_context('url') }}:{{ glance_tls_proxy_stats_port }}"]
-glance_tls_proxy_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}"
-glance_tls_proxy_healthcheck:
- interval: "{{ glance_tls_proxy_healthcheck_interval }}"
- retries: "{{ glance_tls_proxy_healthcheck_retries }}"
- start_period: "{{ glance_tls_proxy_healthcheck_start_period }}"
- test: "{% if glance_tls_proxy_enable_healthchecks | bool %}{{ glance_tls_proxy_healthcheck_test }}{% else %}NONE{% endif %}"
- timeout: "{{ glance_tls_proxy_healthcheck_timeout }}"
-
glance_api_default_volumes:
- "{{ node_config_directory }}/glance-api/:{{ container_config_directory }}/:ro"
- "/etc/localtime:/etc/localtime:ro"
@@ -208,16 +157,9 @@ glance_api_default_volumes:
# NOTE(yoctozepto): below to support Cinder iSCSI backends
- "{% if enable_cinder | bool and enable_cinder_backend_iscsi | bool %}iscsi_info:/etc/iscsi{% endif %}"
- "{% if enable_cinder | bool and enable_cinder_backend_iscsi | bool %}/dev:/dev{% endif %}"
-glance_tls_proxy_default_volumes:
- - "{{ node_config_directory }}/glance-tls-proxy/:{{ container_config_directory }}/:ro"
- - "/etc/localtime:/etc/localtime:ro"
- - "{{ '/etc/timezone:/etc/timezone:ro' if ansible_facts.os_family == 'Debian' else '' }}"
- - "kolla_logs:/var/log/kolla/"
- - "{{ '/dev/shm:/dev/shm' }}"
glance_extra_volumes: "{{ default_extra_volumes }}"
glance_api_extra_volumes: "{{ glance_extra_volumes }}"
-glance_tls_proxy_extra_volumes: "{{ glance_extra_volumes }}"
glance_api_container_proxy: "{{ container_proxy }}"
@@ -273,29 +215,6 @@ glance_source_version: "{{ kolla_source_version }}"
# Default maximum size of 10Gb
glance_cache_max_size: "10737418240"
-####################
-# Backend TLS proxy
-####################
-syslog_server: "{{ api_interface_address }}"
-syslog_glance_tls_proxy_facility: "local2"
-
-glance_tls_proxy_max_connections: 40000
-glance_tls_proxy_threads: 1
-glance_tls_proxy_thread_cpu_map: "no"
-glance_tls_proxy_defaults_max_connections: 10000
-
-# Glance TLS proxy timeout values
-glance_tls_proxy_http_request_timeout: "10s"
-glance_tls_proxy_http_keep_alive_timeout: "10s"
-glance_tls_proxy_queue_timeout: "1m"
-glance_tls_proxy_connect_timeout: "10s"
-glance_tls_proxy_client_timeout: "{{ haproxy_glance_api_client_timeout }}"
-glance_tls_proxy_server_timeout: "{{ haproxy_glance_api_server_timeout }}"
-glance_tls_proxy_check_timeout: "10s"
-
-# Check http://www.haproxy.org/download/1.5/doc/configuration.txt for available options
-glance_tls_proxy_defaults_balance: "roundrobin"
-
# Database
glance_database_enable_tls_internal: "{{ database_enable_tls_internal | bool }}"
diff --git a/ansible/roles/glance/tasks/config.yml b/ansible/roles/glance/tasks/config.yml
index fc328a6de..7c3559bea 100644
--- a/ansible/roles/glance/tasks/config.yml
+++ b/ansible/roles/glance/tasks/config.yml
@@ -38,18 +38,6 @@
when:
- glance_copy_certs | bool
-- name: Creating TLS backend PEM File
- vars:
- service: "{{ glance_services['glance-tls-proxy'] }}"
- assemble:
- src: "{{ node_config_directory }}/glance-tls-proxy/"
- dest: "{{ node_config_directory }}/glance-tls-proxy/glance-cert-and-key.pem"
- mode: "0660"
- regexp: "^glance-(cert|key)\\.pem$"
- remote_src: true
- become: true
- when: service | service_enabled_and_mapped_to_host
-
- name: Copying over config.json files for services
template:
src: "{{ item.key }}.json.j2"
@@ -58,6 +46,24 @@
become: true
with_dict: "{{ glance_services | select_services_enabled_and_mapped_to_host }}"
+- name: "Configure uWSGI for Glance"
+ include_role:
+ name: service-uwsgi-config
+ vars:
+ project_services: "{{ glance_services }}"
+ service: "{{ glance_services['glance-api'] }}"
+ service_name: "glance-api"
+ service_uwsgi_config_http_port: "{{ glance_api_listen_port }}"
+ service_uwsgi_config_log_file_chmod: "644"
+ service_uwsgi_config_module: "{{ service.wsgi }}"
+ service_uwsgi_config_tls_backend: "{{ glance_enable_tls_backend | bool }}"
+ service_uwsgi_config_tls_cert: "/etc/glance/certs/glance-cert.pem"
+ service_uwsgi_config_tls_key: "/etc/glance/certs/glance-key.pem"
+ service_uwsgi_config_workers: "{{ glance_api_workers }}"
+ service_uwsgi_config_uid: "glance"
+ when:
+ - service | service_enabled_and_mapped_to_host
+
- name: Copying over glance-api.conf
vars:
service: "{{ glance_services['glance-api'] }}"
@@ -124,17 +130,3 @@
when:
- glance_policy_file is defined
- service | service_enabled_and_mapped_to_host
-
-- name: Copying over glance-haproxy-tls.cfg
- vars:
- service: "{{ glance_services['glance-tls-proxy'] }}"
- template:
- src: "{{ item }}"
- dest: "{{ node_config_directory }}/glance-tls-proxy/glance-tls-proxy.cfg"
- mode: "0660"
- become: true
- with_first_found:
- - "{{ node_custom_config }}/glance/{{ inventory_hostname }}/glance-tls-proxy.cfg"
- - "{{ node_custom_config }}/glance/glance-tls-proxy.cfg"
- - "glance-tls-proxy.cfg.j2"
- when: service | service_enabled_and_mapped_to_host
diff --git a/ansible/roles/glance/tasks/stop.yml b/ansible/roles/glance/tasks/stop.yml
index 0535ed917..adfea2e6d 100644
--- a/ansible/roles/glance/tasks/stop.yml
+++ b/ansible/roles/glance/tasks/stop.yml
@@ -1,4 +1,13 @@
---
+# TODO(mnasiadka): Remove this task after Gazpacho release
+- name: Remove glance-tls-proxy
+ become: true
+ kolla_container:
+ action: "stop_and_remove_container"
+ common_options: "{{ docker_common_options }}"
+ name: "glance_tls_proxy"
+ ignore_missing: true
+
- name: Stop glance containers
import_role:
name: service-stop
diff --git a/ansible/roles/glance/tasks/upgrade.yml b/ansible/roles/glance/tasks/upgrade.yml
index c6b13ddb2..9cb7bde7e 100644
--- a/ansible/roles/glance/tasks/upgrade.yml
+++ b/ansible/roles/glance/tasks/upgrade.yml
@@ -1,4 +1,13 @@
---
+# TODO(mnasiadka): Remove this task after Gazpacho/2026.1 release
+- name: Remove glance-tls-proxy
+ become: true
+ kolla_container:
+ action: "stop_and_remove_container"
+ common_options: "{{ docker_common_options }}"
+ name: "glance_tls_proxy"
+ ignore_missing: true
+
- name: Include tasks from rolling_upgrade.yml
include_tasks: rolling_upgrade.yml
when: glance_enable_rolling_upgrade | bool
diff --git a/ansible/roles/glance/templates/glance-api.conf.j2 b/ansible/roles/glance/templates/glance-api.conf.j2
index f87d942eb..47bacdf2a 100644
--- a/ansible/roles/glance/templates/glance-api.conf.j2
+++ b/ansible/roles/glance/templates/glance-api.conf.j2
@@ -6,11 +6,7 @@ log_file = /var/log/kolla/glance/glance-api.log
worker_self_reference_url = {{ 'https' if glance_enable_tls_backend | bool else 'http' }}://{{ api_interface_address | put_address_in_context('url') }}:{{ glance_api_port }}
-{% if glance_enable_tls_backend | bool %}
-bind_host = 127.0.0.1
-{% else %}
bind_host = {{ api_interface_address }}
-{% endif %}
bind_port = {{ glance_api_listen_port }}
workers = {{ glance_api_workers }}
diff --git a/ansible/roles/glance/templates/glance-api.json.j2 b/ansible/roles/glance/templates/glance-api.json.j2
index 8cbf9cf2e..8600f05a5 100644
--- a/ansible/roles/glance/templates/glance-api.json.j2
+++ b/ansible/roles/glance/templates/glance-api.json.j2
@@ -1,17 +1,35 @@
{
- "command": "glance-api",
+ "command": "uwsgi /etc/glance/glance-api-uwsgi.ini",
"config_files": [
{
"source": "{{ container_config_directory }}/glance-api.conf",
"dest": "/etc/glance/glance-api.conf",
"owner": "glance",
"perm": "0600"
+ },
+ {
+ "source": "{{ container_config_directory }}/glance-api-uwsgi.ini",
+ "dest": "/etc/glance/glance-api-uwsgi.ini",
+ "owner": "glance",
+ "perm": "0600"
}{% if glance_policy_file is defined %},
{
"source": "{{ container_config_directory }}/{{ glance_policy_file }}",
"dest": "/etc/glance/{{ glance_policy_file }}",
"owner": "glance",
"perm": "0600"
+ }{% endif %}{% if glance_copy_certs | bool %},
+ {
+ "source": "{{ container_config_directory }}/glance-cert.pem",
+ "dest": "/etc/glance/certs/glance-cert.pem",
+ "owner": "glance",
+ "perm": "0600"
+ },
+ {
+ "source": "{{ container_config_directory }}/glance-key.pem",
+ "dest": "/etc/glance/certs/glance-key.pem",
+ "owner": "glance",
+ "perm": "0600"
}{% endif %}{% if glance_backend_ceph | bool %},
{
"source": "{{ container_config_directory }}/ceph",
diff --git a/ansible/roles/glance/templates/glance-tls-proxy.cfg.j2 b/ansible/roles/glance/templates/glance-tls-proxy.cfg.j2
deleted file mode 100644
index 302938d93..000000000
--- a/ansible/roles/glance/templates/glance-tls-proxy.cfg.j2
+++ /dev/null
@@ -1,49 +0,0 @@
-#jinja2: lstrip_blocks: True
-global
- chroot /var/lib/haproxy
- user glance
- group glance
- daemon
- log {{ syslog_server }}:{{ syslog_udp_port }} {{ syslog_glance_tls_proxy_facility }}
- maxconn {{ glance_tls_proxy_max_connections }}
- nbthread {{ glance_tls_proxy_threads }}
- {% if (glance_tls_proxy_threads | int > 1) and (glance_tls_proxy_thread_cpu_map | bool) %}
- cpu-map auto:1/all 0-63
- {% endif %}
- {% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}
- {% for line in haproxy_ssl_settings.split('\n') %}
- {{ line }}
- {% endfor %}
- tune.ssl.default-dh-param 4096
- ca-base {{ haproxy_backend_cacert_dir }}
- {% endif %}
-
-defaults
- log global
- option redispatch
- retries 3
- timeout http-request {{ glance_tls_proxy_http_request_timeout }}
- timeout http-keep-alive {{ glance_tls_proxy_http_keep_alive_timeout }}
- timeout queue {{ glance_tls_proxy_queue_timeout }}
- timeout connect {{ glance_tls_proxy_connect_timeout }}
- timeout client {{ glance_tls_proxy_client_timeout }}
- timeout server {{ glance_tls_proxy_server_timeout }}
- timeout check {{ glance_tls_proxy_check_timeout }}
- balance {{ glance_tls_proxy_defaults_balance }}
- maxconn {{ glance_tls_proxy_defaults_max_connections }}
-
-listen stats
- bind {{ api_interface_address }}:{{ glance_tls_proxy_stats_port }}
- mode http
- stats enable
- stats uri /
- stats refresh 15s
- stats realm Haproxy\ Stats
- stats auth {{ haproxy_user }}:{{ haproxy_password }}
-
-frontend glance_backend_tls
- bind {{ api_interface_address }}:{{ glance_api_listen_port }} ssl crt /etc/glance/certs/glance-cert-and-key.pem
- default_backend glance_api
-
-backend glance_api
- server glance-api 127.0.0.1:{{ glance_api_listen_port }} check
diff --git a/ansible/roles/glance/templates/glance-tls-proxy.json.j2 b/ansible/roles/glance/templates/glance-tls-proxy.json.j2
deleted file mode 100644
index 1eb1afacc..000000000
--- a/ansible/roles/glance/templates/glance-tls-proxy.json.j2
+++ /dev/null
@@ -1,23 +0,0 @@
-{
- "command": "/usr/sbin/haproxy -W -db -p /run/haproxy.pid -f /etc/glance/glance-tls-proxy.cfg",
- "config_files": [
- {
- "source": "{{ container_config_directory }}/glance-tls-proxy.cfg",
- "dest": "/etc/glance/glance-tls-proxy.cfg",
- "owner": "glance",
- "perm": "0600"
- },
- {
- "source": "{{ container_config_directory }}/glance-cert-and-key.pem",
- "dest": "/etc/glance/certs/glance-cert-and-key.pem",
- "owner": "glance",
- "perm": "0600"
- }{% if kolla_copy_ca_into_containers | bool %},
- {
- "source": "{{ container_config_directory }}/ca-certificates",
- "dest": "/var/lib/kolla/share/ca-certificates",
- "owner": "root",
- "perm": "0600"
- }{% endif %}
- ]
-}
diff --git a/ansible/roles/loadbalancer/tasks/upgrade.yml b/ansible/roles/loadbalancer/tasks/upgrade.yml
index 7e2ffb641..8ba054c47 100644
--- a/ansible/roles/loadbalancer/tasks/upgrade.yml
+++ b/ansible/roles/loadbalancer/tasks/upgrade.yml
@@ -19,6 +19,15 @@
- inventory_hostname in groups['loadbalancer']
# TODO(mnasiadka): Remove this task after Gazpacho release
+- name: Removing config for glance-tls-proxy
+ file:
+ path: "{{ node_config_directory }}/haproxy/services.d/glance-tls-proxy.cfg"
+ state: "absent"
+ become: true
+ when:
+ - inventory_hostname in groups['loadbalancer']
+
+# TODO(mnasiadka): Remove this task after Gazpacho release
- name: Removing config for neutron-tls-proxy
file:
path: "{{ node_config_directory }}/haproxy/services.d/neutron-tls-proxy.cfg"
diff --git a/doc/source/admin/advanced-configuration.rst b/doc/source/admin/advanced-configuration.rst
index c0177341a..579dd11ca 100644
--- a/doc/source/admin/advanced-configuration.rst
+++ b/doc/source/admin/advanced-configuration.rst
@@ -271,10 +271,6 @@ By default, HAProxy uses ``local1``.
syslog_haproxy_facility: "local1"
-If Glance TLS backend is enabled (``glance_enable_tls_backend``), the syslog
-facility for the ``glance_tls_proxy`` service uses ``local2`` by default. This
-can be set via ``syslog_glance_tls_proxy_facility``.
-
Mount additional Docker volumes in containers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/kolla_ansible/tests/unit/test_filters.py b/kolla_ansible/tests/unit/test_filters.py
index c6c6adf75..6ea3c51b6 100644
--- a/kolla_ansible/tests/unit/test_filters.py
+++ b/kolla_ansible/tests/unit/test_filters.py
@@ -306,69 +306,6 @@ class TestFilters(unittest.TestCase):
"",
""
]
- },
- "glance-tls-proxy": {
- "container_name": "glance_tls_proxy",
- "dimensions": {},
- "enabled": True,
- "group": "glance-api",
- "haproxy": {
- "glance_tls_proxy": {
- "backend_http_extra": [
- "timeout server 6h"
- ],
- "custom_member_list": [
- "server someserver 1.2.3.4:9292 "
- "check inter 2000 rise 2 fall 5 ssl verify "
- "required ca-file ca-bundle.trust.crt",
- ""
- ],
- "enabled": True,
- "external": False,
- "frontend_http_extra": [
- "timeout client 6h"
- ],
- "mode": "http",
- "port": "9292",
- "tls_backend": "yes"
- },
- "glance_tls_proxy_external": {
- "backend_http_extra": [
- "timeout server 6h"
- ],
- "custom_member_list": [
- "server someserver 1.2.3.4:9292 "
- "check inter 2000 rise 2 fall 5 ssl verify "
- "required ca-file ca-bundle.trust.crt",
- ""
- ],
- "enabled": True,
- "external": True,
- "frontend_http_extra": [
- "timeout client 6h"
- ],
- "mode": "http",
- "port": "9292",
- "tls_backend": "yes"
- }
- },
- "healthcheck": {
- "interval": "30",
- "retries": "3",
- "start_period": "5",
- "test": [
- "CMD-SHELL",
- "healthcheck_curl -u openstack:asdf 1.2.3.4:9293"
- ],
- "timeout": "30"
- },
- "host_in_groups": True,
- "image": "centos-source-haproxy:latest",
- "volumes": [
- "/etc/localtime:/etc/localtime:ro",
- "",
- "kolla_logs:/var/log/kolla/"
- ]
}
}
expected = {
@@ -403,43 +340,6 @@ class TestFilters(unittest.TestCase):
],
"mode": "http",
"port": "9292"
- },
- "glance_tls_proxy": {
- "backend_http_extra": [
- "timeout server 6h"
- ],
- 'custom_member_list': ['server someserver 1.2.3.4:9292 '
- 'check inter 2000 rise 2 fall 5 '
- 'ssl verify required ca-file '
- 'ca-bundle.trust.crt',
- ''],
- "enabled": True,
- "external": False,
- "frontend_http_extra": [
- "timeout client 6h"
- ],
- "mode": "http",
- "port": "9292",
- "tls_backend": "yes"
- },
- "glance_tls_proxy_external": {
- "backend_http_extra": [
- "timeout server 6h"
- ],
- 'custom_member_list': ['server someserver 1.2.3.4:9292 '
- 'check inter 2000 rise 2 fall 5 '
- 'ssl verify required ca-file '
- 'ca-bundle.trust.crt',
- ''],
-
- "enabled": True,
- "external": True,
- "frontend_http_extra": [
- "timeout client 6h"
- ],
- "mode": "http",
- "port": "9292",
- "tls_backend": "yes"
}
}
actual = filters.extract_haproxy_services(self.context,
diff --git a/releasenotes/notes/uwsgi-glance-97f43edefef2112b.yaml b/releasenotes/notes/uwsgi-glance-97f43edefef2112b.yaml
new file mode 100644
index 000000000..5f41ccc6a
--- /dev/null
+++ b/releasenotes/notes/uwsgi-glance-97f43edefef2112b.yaml
@@ -0,0 +1,7 @@
+---
+upgrade:
+ - |
+ ``glance-api`` is now running under uWSGI and supports backend TLS without
+ the additional haproxy container.
+ The ``glance-tls-proxy`` container will be removed during the upgrade
+ process.
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 17:48:19 +0000