diff options
68 files changed, 643 insertions, 714 deletions
diff --git a/ansible/roles/ceilometer/templates/pipeline.yaml.j2 b/ansible/roles/ceilometer/templates/pipeline.yaml.j2 index 376559ce3..3d169a1e2 100644 --- a/ansible/roles/ceilometer/templates/pipeline.yaml.j2 +++ b/ansible/roles/ceilometer/templates/pipeline.yaml.j2 @@ -1,3 +1,4 @@ +{# j2lint: disable=jinja-variable-lower-case #} --- sources: - name: meter_source @@ -12,5 +13,5 @@ sinks: - gnocchi:// {% endif %} {% if enable_ceilometer_prometheus_pushgateway | bool %} - - prometheus://{{ ceilometer_prometheus_pushgateway_host }}:{{ ceilometer_prometheus_pushgateway_port }}/metrics/job/openstack-telemetry{% if ceilometer_prometheus_pushgateway_options %}/?{{ (ceilometer_prometheus_pushgateway_options | dict2items | rejectattr("value", "equalto", None) | list | items2dict).items() | map("join", "=") | join("&")}}{% endif %} + - prometheus://{{ ceilometer_prometheus_pushgateway_host }}:{{ ceilometer_prometheus_pushgateway_port }}/metrics/job/openstack-telemetry{% if ceilometer_prometheus_pushgateway_options %}/?{{ (ceilometer_prometheus_pushgateway_options | dict2items | rejectattr("value", "equalto", None) | list | items2dict).items() | map("join", "=") | join("&") }}{% endif %} {% endif %} diff --git a/ansible/roles/cinder/templates/cinder-volume.json.j2 b/ansible/roles/cinder/templates/cinder-volume.json.j2 index 7ccf1e743..db17a736e 100644 --- a/ansible/roles/cinder/templates/cinder-volume.json.j2 +++ b/ansible/roles/cinder/templates/cinder-volume.json.j2 @@ -13,7 +13,7 @@ "owner": "cinder", "perm": "0600", "optional": {{ (not cinder_backend_huawei | bool) | string | lower }} - },{% endfor%}{% endif %}{% if cinder_backend_ceph | bool %} + },{% endfor %}{% endif %}{% if cinder_backend_ceph | bool %} { "source": "{{ container_config_directory }}/ceph", "dest": "/etc/ceph", diff --git a/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 b/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 index b663c73b4..d0f090bb0 100644 --- a/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 +++ b/ansible/roles/cinder/templates/cinder-wsgi.conf.j2 @@ -1,9 +1,9 @@ {% if cinder_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ cinder_api_listen_port }} diff --git a/ansible/roles/cinder/templates/cinder.conf.j2 b/ansible/roles/cinder/templates/cinder.conf.j2 index 89171cdfb..5e9fb5337 100644 --- a/ansible/roles/cinder/templates/cinder.conf.j2 +++ b/ansible/roles/cinder/templates/cinder.conf.j2 @@ -25,13 +25,13 @@ cluster = {{ cinder_cluster_name }} {% endif %} {% if cinder_enabled_backends %} -{% if service_name == 'cinder-volume' %} -enabled_backends = {{ cinder_enabled_backends|map(attribute='name')|join(',') }} -{% endif %} +{% if service_name == 'cinder-volume' %} +enabled_backends = {{ cinder_enabled_backends | map(attribute='name') | join(',') }} +{% endif %} {% endif %} {% if service_name == "cinder-backup" and enable_cinder_backup | bool %} -{% if cinder_backup_driver == "ceph" %} +{% if cinder_backup_driver == "ceph" %} backup_driver = cinder.backup.drivers.ceph.CephBackupDriver backup_ceph_conf = /etc/ceph/{{ cinder_backup_ceph_backend['cluster'] }}.conf backup_ceph_user = {{ cinder_backup_ceph_backend['user'] }} @@ -40,19 +40,19 @@ backup_ceph_pool = {{ cinder_backup_ceph_backend['pool'] }} backup_ceph_stripe_unit = 0 backup_ceph_stripe_count = 0 restore_discard_excess_bytes = true -{% elif cinder_backup_driver == "nfs" %} +{% elif cinder_backup_driver == "nfs" %} backup_driver = cinder.backup.drivers.nfs.NFSBackupDriver backup_mount_options = {{ cinder_backup_mount_options_nfs }} backup_mount_point_base = /var/lib/cinder/backup backup_share = {{ cinder_backup_share }} backup_file_size = 327680000 -{% elif cinder_backup_driver == "s3" %} +{% elif cinder_backup_driver == "s3" %} backup_driver = cinder.backup.drivers.s3.S3BackupDriver backup_s3_endpoint_url = {{ cinder_backup_s3_url }} backup_s3_store_bucket = {{ cinder_backup_s3_bucket }} backup_s3_store_access_key = {{ cinder_backup_s3_access_key }} backup_s3_store_secret_key = {{ cinder_backup_s3_secret_key }} -{% endif %} +{% endif %} {% endif %} api_paste_config = /etc/cinder/api-paste.ini @@ -148,8 +148,8 @@ target_protocol = iscsi {% endif %} {% if cinder_backend_ceph | bool %} -{% if service_name == 'cinder-volume' %} -{% for backend in cinder_ceph_backends %} +{% if service_name == 'cinder-volume' %} +{% for backend in cinder_ceph_backends %} [{{ backend.name }}] volume_driver = cinder.volume.drivers.rbd.RBDDriver volume_backend_name = {{ backend.backend_name | default(backend.name) }} @@ -161,11 +161,11 @@ rbd_cluster_name = {{ backend.cluster }} rbd_keyring_conf = /etc/ceph/{{ backend.cluster }}.client.{{ backend.user }}.keyring rbd_secret_uuid = {{ cinder_rbd_secret_uuid }} report_discard_supported = true -{% if backend.availability_zone is defined %} +{% if backend.availability_zone is defined %} backend_availability_zone = {{ backend.availability_zone }} -{% endif %} -{% endfor %} -{% endif %} +{% endif %} +{% endfor %} +{% endif %} {% endif %} {% if enable_cinder_backend_nfs | bool %} @@ -225,7 +225,7 @@ lightos_api_address = {{ lightbits_target_ips }} lightos_api_port = {{ lightbits_api_port }} lightos_default_num_replicas = {{ lightbits_default_num_replicas }} lightos_skip_ssl_verify = {{ lightbits_skip_ssl_verify | bool }} -lightos_jwt = {{ lightbits_JWT }} +lightos_jwt = {{ lightbits_jwt }} {% endif %} [privsep_entrypoint] diff --git a/ansible/roles/cloudkitty/templates/cloudkitty.conf.j2 b/ansible/roles/cloudkitty/templates/cloudkitty.conf.j2 index 05b653951..7cb08533a 100644 --- a/ansible/roles/cloudkitty/templates/cloudkitty.conf.j2 +++ b/ansible/roles/cloudkitty/templates/cloudkitty.conf.j2 @@ -79,9 +79,9 @@ prometheus_url = {{ cloudkitty_prometheus_url }} prometheus_user = admin prometheus_password = {{ prometheus_password }} -{% if cloudkitty_prometheus_cafile is defined %} +{% if cloudkitty_prometheus_cafile is defined %} cafile = {{ cloudkitty_prometheus_cafile }} -{% endif %} +{% endif %} insecure = {{ cloudkitty_prometheus_insecure_connections }} {% endif %} @@ -105,9 +105,9 @@ prometheus_url = {{ cloudkitty_prometheus_url }} prometheus_user = admin prometheus_password = {{ prometheus_password }} -{% if cloudkitty_prometheus_cafile is defined %} +{% if cloudkitty_prometheus_cafile is defined %} cafile = {{ cloudkitty_prometheus_cafile }} -{% endif %} +{% endif %} insecure = {{ cloudkitty_prometheus_insecure_connections }} {% endif %} @@ -134,21 +134,21 @@ database = {{ cloudkitty_influxdb_name }} host = {{ influxdb_address }} port = {{ influxdb_http_port }} -{% if cloudkitty_influxdb_retention_policy is defined %} +{% if cloudkitty_influxdb_retention_policy is defined %} retention_policy = {{ cloudkitty_influxdb_retention_policy }} -{% endif %} +{% endif %} -{% if cloudkitty_influxdb_use_ssl is defined %} +{% if cloudkitty_influxdb_use_ssl is defined %} use_ssl = {{ cloudkitty_influxdb_use_ssl }} -{% endif %} +{% endif %} -{% if cloudkitty_influxdb_insecure_connections is defined %} +{% if cloudkitty_influxdb_insecure_connections is defined %} insecure = {{ cloudkitty_influxdb_insecure_connections }} -{% endif %} +{% endif %} -{% if cloudkitty_influxdb_cafile is defined %} +{% if cloudkitty_influxdb_cafile is defined %} cafile = {{ cloudkitty_influxdb_cafile }} -{% endif %} +{% endif %} {% endif %} @@ -158,9 +158,9 @@ host = {{ cloudkitty_elasticsearch_url }} index_name = {{ cloudkitty_elasticsearch_index_name }} insecure = {{ cloudkitty_elasticsearch_insecure_connections }} -{% if cloudkitty_elasticsearch_cafile | length > 0 %} +{% if cloudkitty_elasticsearch_cafile | length > 0 %} cafile = {{ cloudkitty_elasticsearch_cafile }} -{% endif %} +{% endif %} {% endif %} {% if cloudkitty_storage_backend == 'opensearch' %} @@ -169,7 +169,7 @@ host = {{ cloudkitty_opensearch_url }} index_name = {{ cloudkitty_opensearch_index_name }} insecure = {{ cloudkitty_opensearch_insecure_connections }} -{% if cloudkitty_opensearch_cafile | length > 0 %} +{% if cloudkitty_opensearch_cafile | length > 0 %} cafile = {{ cloudkitty_opensearch_cafile }} -{% endif %} +{% endif %} {% endif %} diff --git a/ansible/roles/cron/templates/cron-logrotate-global.conf.j2 b/ansible/roles/cron/templates/cron-logrotate-global.conf.j2 index f57a2e034..b8628a88d 100644 --- a/ansible/roles/cron/templates/cron-logrotate-global.conf.j2 +++ b/ansible/roles/cron/templates/cron-logrotate-global.conf.j2 @@ -19,6 +19,6 @@ maxsize {{ cron_logrotate_log_maxsize }} su root kolla {% for service in cron_logrotate_enabled_services %} -{% include "cron-logrotate-" ~ service ~ ".conf.j2" %} +{% include "cron-logrotate-" ~ service ~ ".conf.j2" %} {% endfor %} diff --git a/ansible/roles/designate/templates/pools.yaml.j2 b/ansible/roles/designate/templates/pools.yaml.j2 index 2ec767254..6bf85ce91 100644 --- a/ansible/roles/designate/templates/pools.yaml.j2 +++ b/ansible/roles/designate/templates/pools.yaml.j2 @@ -4,61 +4,61 @@ description: Default BIND9 Pool attributes: {} ns_records: -{% if designate_ns_record is string %} +{% if designate_ns_record is string %} - hostname: {{ designate_ns_record }}. priority: 1 -{% else %} -{% for host in designate_ns_record %} +{% else %} +{% for host in designate_ns_record %} - hostname: {{ host }}. priority: 1 -{% endfor %} -{% endif %} +{% endfor %} +{% endif %} nameservers: -{% if designate_backend == 'bind9' %} -{% for host in groups['designate-backend-bind9'] %} +{% if designate_backend == 'bind9' %} +{% for host in groups['designate-backend-bind9'] %} - host: {{ 'api' | kolla_address(host) }} port: {{ designate_bind_port }} -{% endfor %} -{% elif designate_backend_external == 'bind9' %} -{% for host in designate_backend_external_bind9_nameservers.replace(" ", "").split(',') %} +{% endfor %} +{% elif designate_backend_external == 'bind9' %} +{% for host in designate_backend_external_bind9_nameservers.replace(" ", "").split(',') %} - host: {{ host }} port: {{ designate_bind_port }} -{% endfor %} -{% endif %} +{% endfor %} +{% endif %} targets: -{% if designate_backend == 'bind9' %} -{% for bind_host in groups['designate-backend-bind9'] %} +{% if designate_backend == 'bind9' %} +{% for bind_host in groups['designate-backend-bind9'] %} - type: bind9 description: BIND9 Server {{ 'api' | kolla_address(bind_host) }} masters: -{% for mdns_host in groups['designate-mdns'] %} +{% for mdns_host in groups['designate-mdns'] %} - host: {{ 'dns' | kolla_address(mdns_host) }} port: {{ designate_mdns_port }} -{% endfor %} +{% endfor %} options: host: {{ 'api' | kolla_address(bind_host) }} port: {{ designate_bind_port }} rndc_host: {{ 'api' | kolla_address(bind_host) }} rndc_port: {{ designate_rndc_port }} rndc_key_file: /etc/designate/rndc.key -{% endfor %} -{% elif designate_backend_external == 'bind9' %} -{% for bind_host in designate_backend_external_bind9_nameservers.replace(" ", "").split(',') %} +{% endfor %} +{% elif designate_backend_external == 'bind9' %} +{% for bind_host in designate_backend_external_bind9_nameservers.replace(" ", "").split(',') %} - type: bind9 description: BIND9 Server {{ bind_host }} masters: -{% for mdns_host in groups['designate-mdns'] %} +{% for mdns_host in groups['designate-mdns'] %} - host: {{ 'dns' | kolla_address(mdns_host) }} port: {{ designate_mdns_port }} -{% endfor %} +{% endfor %} options: host: {{ bind_host }} port: {{ designate_bind_port }} rndc_host: {{ bind_host }} rndc_port: {{ designate_rndc_port }} rndc_key_file: /etc/designate/rndc.key -{% endfor %} -{% endif %} +{% endfor %} +{% endif %} {% elif designate_backend == 'infoblox' %} - name: infoblox id: {{ designate_pool_id }} @@ -69,23 +69,23 @@ - hostname: {{ designate_ns_record }}. priority: 1 nameservers: -{% for host in designate_backend_infoblox_nameservers.replace(" ", "").split(',') %} +{% for host in designate_backend_infoblox_nameservers.replace(" ", "").split(',') %} - host: {{ host }} port: {{ designate_bind_port }} -{% endfor %} +{% endfor %} also_notifies: -{% for host in designate_backend_infoblox_nameservers.replace(" ", "").split(',') %} +{% for host in designate_backend_infoblox_nameservers.replace(" ", "").split(',') %} - host: {{ host }} port: {{ designate_bind_port }} -{% endfor %} +{% endfor %} targets: - type: infoblox description: Default Infoblox Pool masters: -{% for mdns_host in groups['designate-mdns'] %} +{% for mdns_host in groups['designate-mdns'] %} - host: {{ 'dns' | kolla_address(mdns_host) }} port: {{ designate_mdns_port }} -{% endfor %} +{% endfor %} options: host: {{ designate_infoblox_host }} port: 53 diff --git a/ansible/roles/fluentd/templates/conf/input/00-global.conf.j2 b/ansible/roles/fluentd/templates/conf/input/00-global.conf.j2 index 7d236215e..e94f83b92 100644 --- a/ansible/roles/fluentd/templates/conf/input/00-global.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/input/00-global.conf.j2 @@ -1,5 +1,5 @@ #jinja2: trim_blocks: False -{% if fluentd_enabled_input_openstack_services | length > 0 -%} +{% if fluentd_enabled_input_openstack_services | length > 0 %} <source> @type tail path {% for service in fluentd_enabled_input_openstack_services %}/var/log/kolla/{{ service }}/*.log{% if not loop.last %},{% endif %}{% endfor %} @@ -23,4 +23,4 @@ time_format %F %T.%L </parse> </source> -{%- endif %} +{% endif %} diff --git a/ansible/roles/fluentd/templates/conf/input/10-openvswitch.conf.j2 b/ansible/roles/fluentd/templates/conf/input/10-openvswitch.conf.j2 index e60a705d8..dce57223d 100644 --- a/ansible/roles/fluentd/templates/conf/input/10-openvswitch.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/input/10-openvswitch.conf.j2 @@ -29,7 +29,7 @@ </source> {% if enable_ovn | bool %} -{% if inventory_hostname in groups.get('ovn-controller', []) %} +{% if inventory_hostname in groups.get('ovn-controller', []) %} <source> @type tail path /var/log/kolla/openvswitch/ovn-controller.log @@ -44,9 +44,9 @@ time_format %FT%T.%L </parse> </source> -{% endif %} -{% for ovn_service in ['ovn-nb-db', 'ovn-northd', 'ovn-sb-db'] %} -{% if inventory_hostname in groups.get(ovn_service, []) %} +{% endif %} +{% for ovn_service in ['ovn-nb-db', 'ovn-northd', 'ovn-sb-db'] %} +{% if inventory_hostname in groups.get(ovn_service, []) %} <source> @type tail path /var/log/kolla/openvswitch/{{ ovn_service }}.log @@ -61,10 +61,10 @@ time_format %FT%T.%L </parse> </source> -{% endif %} -{% endfor %} -{% for relay_id in range(1, ovn_sb_db_relay_count | int + 1) %} -{% if inventory_hostname in groups.get('ovn-sb-db-relay', []) %} +{% endif %} +{% endfor %} +{% for relay_id in range(1, ovn_sb_db_relay_count | int + 1) %} +{% if inventory_hostname in groups.get('ovn-sb-db-relay', []) %} <source> @type tail path /var/log/kolla/openvswitch/ovn-sb-relay-{{ relay_id }}.log @@ -79,6 +79,6 @@ time_format %FT%T.%L </parse> </source> -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} diff --git a/ansible/roles/fluentd/templates/conf/input/13-uwsgi.conf.j2 b/ansible/roles/fluentd/templates/conf/input/13-uwsgi.conf.j2 index f1100a67b..a2ef26e39 100644 --- a/ansible/roles/fluentd/templates/conf/input/13-uwsgi.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/input/13-uwsgi.conf.j2 @@ -1,5 +1,5 @@ #jinja2: trim_blocks: False -{% if fluentd_enabled_input_openstack_services | length > 0 -%} +{% if fluentd_enabled_input_openstack_services | length > 0 %} <source> @type tail path {% for service in fluentd_enabled_input_openstack_services %}/var/log/kolla/{{ service }}/*-uwsgi.log{% if not loop.last %},{% endif %}{% endfor %} @@ -15,4 +15,4 @@ time_format %c </parse> </source> -{%- endif %} +{% endif %} diff --git a/ansible/roles/fluentd/templates/conf/output/00-local.conf.j2 b/ansible/roles/fluentd/templates/conf/output/00-local.conf.j2 index 15fc270c5..dce221080 100644 --- a/ansible/roles/fluentd/templates/conf/output/00-local.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/output/00-local.conf.j2 @@ -14,26 +14,26 @@ output_time {{ item.output_time | default(false) | lower }} </format> </store> -{% if log_direct_to_elasticsearch %} +{% if log_direct_to_elasticsearch %} <store> @type elasticsearch host {{ elasticsearch_address }} port {{ elasticsearch_port | default('9200') }} scheme {{ fluentd_elasticsearch_scheme }} -{% if fluentd_elasticsearch_path != '' %} +{% if fluentd_elasticsearch_path != '' %} path {{ fluentd_elasticsearch_path }} -{% endif %} -{% if fluentd_elasticsearch_scheme == 'https' %} +{% endif %} +{% if fluentd_elasticsearch_scheme == 'https' %} ssl_version {{ fluentd_elasticsearch_ssl_version }} ssl_verify {{ fluentd_elasticsearch_ssl_verify }} -{% if fluentd_elasticsearch_cacert | length > 0 %} +{% if fluentd_elasticsearch_cacert | length > 0 %} ca_file {{ fluentd_elasticsearch_cacert }} -{% endif %} -{% endif %} -{% if fluentd_elasticsearch_user != '' and fluentd_elasticsearch_password != ''%} +{% endif %} +{% endif %} +{% if fluentd_elasticsearch_user != '' and fluentd_elasticsearch_password != '' %} user {{ fluentd_elasticsearch_user }} password {{ fluentd_elasticsearch_password }} -{% endif %} +{% endif %} logstash_format true logstash_prefix {{ opensearch_log_index_prefix }} reconnect_on_error true @@ -48,26 +48,26 @@ chunk_limit_size {{ fluentd_buffer_chunk_limit_size }} </buffer> </store> -{% elif log_direct_to_opensearch %} +{% elif log_direct_to_opensearch %} <store> @type opensearch hosts {% for host in groups['opensearch'] %}{{ 'api' | kolla_address(host) }}{% if not loop.last %},{% endif %}{% endfor %} port {{ opensearch_port }} scheme {{ fluentd_opensearch_scheme }} -{% if fluentd_opensearch_path != '' %} +{% if fluentd_opensearch_path != '' %} path {{ fluentd_opensearch_path }} -{% endif %} -{% if fluentd_opensearch_scheme == 'https' %} +{% endif %} +{% if fluentd_opensearch_scheme == 'https' %} ssl_version {{ fluentd_opensearch_ssl_version }} ssl_verify {{ fluentd_opensearch_ssl_verify }} -{% if fluentd_opensearch_cacert | length > 0 %} +{% if fluentd_opensearch_cacert | length > 0 %} ca_file {{ fluentd_opensearch_cacert }} -{% endif %} -{% endif %} -{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != ''%} +{% endif %} +{% endif %} +{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != '' %} user {{ fluentd_opensearch_user }} password {{ fluentd_opensearch_password }} -{% endif %} +{% endif %} logstash_format true logstash_prefix {{ opensearch_log_index_prefix }} reconnect_on_error true @@ -82,6 +82,6 @@ chunk_limit_size {{ fluentd_buffer_chunk_limit_size }} </buffer> </store> -{% endif %} +{% endif %} </match> {% endfor %} diff --git a/ansible/roles/fluentd/templates/conf/output/01-es.conf.j2 b/ansible/roles/fluentd/templates/conf/output/01-es.conf.j2 index 6c4831ef7..da36088a3 100644 --- a/ansible/roles/fluentd/templates/conf/output/01-es.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/output/01-es.conf.j2 @@ -6,36 +6,36 @@ host {{ elasticsearch_address }} port {{ elasticsearch_port | default('9200') }} scheme {{ fluentd_elasticsearch_scheme }} -{% if fluentd_elasticsearch_path != '' %} +{% if fluentd_elasticsearch_path != '' %} path {{ fluentd_elasticsearch_path }} -{% endif %} -{% if fluentd_elasticsearch_scheme == 'https' %} +{% endif %} +{% if fluentd_elasticsearch_scheme == 'https' %} ssl_version {{ fluentd_elasticsearch_ssl_version }} ssl_verify {{ fluentd_elasticsearch_ssl_verify }} -{% if fluentd_elasticsearch_cacert | length > 0 %} +{% if fluentd_elasticsearch_cacert | length > 0 %} ca_file {{ fluentd_elasticsearch_cacert }} -{% endif %} -{% endif %} -{% if fluentd_elasticsearch_user != '' and fluentd_elasticsearch_password != ''%} +{% endif %} +{% endif %} +{% if fluentd_elasticsearch_user != '' and fluentd_elasticsearch_password != '' %} user {{ fluentd_elasticsearch_user }} password {{ fluentd_elasticsearch_password }} -{% endif %} +{% endif %} logstash_format true logstash_prefix {{ opensearch_log_index_prefix }} reconnect_on_error true -{% if match_pattern != 'retry_es' %} +{% if match_pattern != 'retry_es' %} retry_tag retry_es -{% endif %} +{% endif %} request_timeout {{ fluentd_elasticsearch_request_timeout }} suppress_type_name true bulk_message_request_threshold {{ fluentd_bulk_message_request_threshold }} <buffer> @type file -{% if match_pattern == 'retry_es' %} +{% if match_pattern == 'retry_es' %} path /var/lib/fluentd/data/elasticsearch.buffer/openstack_retry.* -{% else %} +{% else %} path /var/lib/fluentd/data/elasticsearch.buffer/openstack.* -{% endif %} +{% endif %} flush_interval 15s chunk_limit_size {{ fluentd_buffer_chunk_limit_size }} </buffer> diff --git a/ansible/roles/fluentd/templates/conf/output/03-opensearch.conf.j2 b/ansible/roles/fluentd/templates/conf/output/03-opensearch.conf.j2 index 02d39f037..1d814a2e6 100644 --- a/ansible/roles/fluentd/templates/conf/output/03-opensearch.conf.j2 +++ b/ansible/roles/fluentd/templates/conf/output/03-opensearch.conf.j2 @@ -6,26 +6,26 @@ hosts {% for host in groups['opensearch'] %}{{ 'api' | kolla_address(host) }}{% if not loop.last %},{% endif %}{% endfor %} port {{ opensearch_port }} scheme {{ fluentd_opensearch_scheme }} -{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != '' -%} +{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != '' %} user {{ fluentd_opensearch_user }} password {{ fluentd_opensearch_password }} -{%- endif %} +{% endif %} logstash_format true logstash_prefix {{ opensearch_log_index_prefix }} reconnect_on_error true -{% if match_pattern != 'retry_os' -%} +{% if match_pattern != 'retry_os' %} retry_tag retry_os -{%- endif %} +{% endif %} request_timeout {{ fluentd_opensearch_request_timeout }} suppress_type_name true bulk_message_request_threshold {{ fluentd_bulk_message_request_threshold }} <buffer> @type file -{% if match_pattern == 'retry_os' -%} +{% if match_pattern == 'retry_os' %} path /var/lib/fluentd/data/opensearch.buffer/openstack_retry.* -{% else %} +{% else %} path /var/lib/fluentd/data/opensearch.buffer/openstack.* -{%- endif %} +{% endif %} flush_interval 15s chunk_limit_size {{ fluentd_buffer_chunk_limit_size }} </buffer> diff --git a/ansible/roles/fluentd/templates/fluentd.conf.j2 b/ansible/roles/fluentd/templates/fluentd.conf.j2 index 7a8e49c16..7954801a6 100644 --- a/ansible/roles/fluentd/templates/fluentd.conf.j2 +++ b/ansible/roles/fluentd/templates/fluentd.conf.j2 @@ -5,37 +5,37 @@ those where possible. #} # Inputs -{%- for path in fluentd_input_files %} -{%- if path.startswith('/') %} +{% for path in fluentd_input_files %} +{% if path.startswith('/') %} {{ lookup('template', path) }} -{%- else %} -{% include path %} -{%- endif %} -{%- endfor %} +{% else %} +{% include path %} +{% endif %} +{% endfor %} # Filters -{%- for path in fluentd_filter_files %} -{%- if path.startswith('/') %} +{% for path in fluentd_filter_files %} +{% if path.startswith('/') %} {{ lookup('template', path) }} -{%- else %} -{% include path %} -{%- endif %} -{%- endfor %} +{% else %} +{% include path %} +{% endif %} +{% endfor %} # Formats -{%- for path in fluentd_format_files %} -{%- if path.startswith('/') %} +{% for path in fluentd_format_files %} +{% if path.startswith('/') %} {{ lookup('template', path) }} -{%- else %} -{% include path %} -{%- endif %} -{%- endfor %} +{% else %} +{% include path %} +{% endif %} +{% endfor %} # Outputs -{%- for path in fluentd_output_files %} -{%- if path.startswith('/') %} +{% for path in fluentd_output_files %} +{% if path.startswith('/') %} {{ lookup('template', path) }} -{%- else %} -{% include path %} -{%- endif %} -{%- endfor %} +{% else %} +{% include path %} +{% endif %} +{% endfor %} diff --git a/ansible/roles/glance/templates/glance-api.conf.j2 b/ansible/roles/glance/templates/glance-api.conf.j2 index 47bacdf2a..f9c23aa96 100644 --- a/ansible/roles/glance/templates/glance-api.conf.j2 +++ b/ansible/roles/glance/templates/glance-api.conf.j2 @@ -1,3 +1,4 @@ +{# j2lint: disable=operator-enclosed-by-spaces #} [DEFAULT] debug = {{ glance_logging_debug }} @@ -60,12 +61,12 @@ filesystem_store_datadir = /var/lib/glance/images/ {% endif %} {% if glance_backend_ceph | bool %} -{% for backend in glance_ceph_backends %} +{% for backend in glance_ceph_backends %} [{{ backend.name }}] rbd_store_user = {{ backend.user }} rbd_store_pool = {{ backend.pool }} rbd_store_ceph_conf = /etc/ceph/{{ backend.cluster }}.conf -{% endfor %} +{% endfor %} {% endif %} {% if glance_backend_s3 | bool %} diff --git a/ansible/roles/grafana/templates/grafana.json.j2 b/ansible/roles/grafana/templates/grafana.json.j2 index 8b47e25e7..b98c53c79 100644 --- a/ansible/roles/grafana/templates/grafana.json.j2 +++ b/ansible/roles/grafana/templates/grafana.json.j2 @@ -8,20 +8,20 @@ "perm": "0600" }, {% if check_extra_conf_grafana is defined %} -{% for extra_conf in check_extra_conf_grafana.files | map(attribute='path') | map('basename') %} +{% for extra_conf in check_extra_conf_grafana.files | map(attribute='path') | map('basename') %} { "source": "{{ container_config_directory }}/{{ extra_conf }}", -{% if extra_conf == 'grafana_home_dashboard.json' %} +{% if extra_conf == 'grafana_home_dashboard.json' %} "dest": "/usr/share/grafana/public/dashboards/home.json", "owner": "root", "perm": "0644" -{% else %} +{% else %} "dest": "/etc/grafana/{{ extra_conf }}", "owner": "grafana", "perm": "0600" -{% endif %} +{% endif %} }, -{% endfor %} +{% endfor %} {% endif %} { "source": "{{ container_config_directory }}/prometheus.yaml", diff --git a/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2 b/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2 index 76a92e9b0..c84083ac2 100644 --- a/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2 +++ b/ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2 @@ -1,165 +1,165 @@ #jinja2: lstrip_blocks: True -{%- set external_tls_bind_info = 'ssl crt /etc/haproxy/certificates/haproxy.pem' if kolla_enable_tls_external|bool else '' %} -{%- set external_tls_bind_info = "%s %s" % (external_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_external|bool and haproxy_enable_http2|bool else external_tls_bind_info %} -{%- set internal_tls_bind_info = 'ssl crt /etc/haproxy/certificates/haproxy-internal.pem' if kolla_enable_tls_internal|bool else '' %} -{%- set internal_tls_bind_info = "%s %s" % (internal_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_internal|bool and haproxy_enable_http2|bool else internal_tls_bind_info %} +{% set external_tls_bind_info = 'ssl crt /etc/haproxy/certificates/haproxy.pem' if kolla_enable_tls_external | bool else '' %} +{% set external_tls_bind_info = "%s %s" % (external_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_external | bool and haproxy_enable_http2 | bool else external_tls_bind_info %} +{% set internal_tls_bind_info = 'ssl crt /etc/haproxy/certificates/haproxy-internal.pem' if kolla_enable_tls_internal | bool else '' %} +{% set internal_tls_bind_info = "%s %s" % (internal_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_internal | bool and haproxy_enable_http2 | bool else internal_tls_bind_info %} -{%- macro userlist_macro(service_name, auth_user, auth_pass) %} +{% macro userlist_macro(service_name, auth_user, auth_pass) %} userlist {{ service_name }}-user user {{ auth_user }} insecure-password {{ auth_pass }} {% endmacro %} -{%- macro frontend_macro(service_name, service_port, service_mode, external, +{% macro frontend_macro(service_name, service_port, service_mode, external, frontend_http_extra, frontend_redirect_extra, frontend_tcp_extra) %} frontend {{ service_name }}_front - {% if service_mode == 'redirect' %} +{% if service_mode == 'redirect' %} mode http - {% else %} +{% else %} mode {{ service_mode }} - {% endif %} - {% if service_mode == 'http' %} - {% if external|bool %} +{% endif %} +{% if service_mode == 'http' %} +{% if external | bool %} http-request deny if { path -i -m beg /server-status } - {% endif %} - {# Delete any pre-populated XFP header #} +{% endif %} +{# Delete any pre-populated XFP header #} http-request del-header X-Forwarded-Proto - {% for http_option in frontend_http_extra %} +{% for http_option in frontend_http_extra %} {{ http_option }} - {% endfor %} - {% elif service_mode == 'tcp' %} - {% for tcp_option in frontend_tcp_extra %} +{% endfor %} +{% elif service_mode == 'tcp' %} +{% for tcp_option in frontend_tcp_extra %} {{ tcp_option }} - {% endfor %} - {% endif %} - {% set tls_option = '' %} - {% if external|bool %} - {% set vip_address = kolla_external_vip_address %} - {% if service_mode == 'http' %} - {% set tls_option = external_tls_bind_info %} - {# Replace the XFP header for external https requests #} +{% endfor %} +{% endif %} +{% set tls_option = '' %} +{% if external | bool %} +{% set vip_address = kolla_external_vip_address %} +{% if service_mode == 'http' %} +{% set tls_option = external_tls_bind_info %} +{# Replace the XFP header for external https requests #} http-request set-header X-Forwarded-Proto https if { ssl_fc } - {% endif %} - {% else %} - {% set vip_address = kolla_internal_vip_address %} - {% if service_mode == 'http' %} - {% set tls_option = internal_tls_bind_info %} - {# Replace the XFP header for internal https requests #} +{% endif %} +{% else %} +{% set vip_address = kolla_internal_vip_address %} +{% if service_mode == 'http' %} +{% set tls_option = internal_tls_bind_info %} +{# Replace the XFP header for internal https requests #} http-request set-header X-Forwarded-Proto https if { ssl_fc } - {% endif %} - {% endif %} - {{ "bind %s:%s %s"|e|format(vip_address, service_port, tls_option)|trim() }} - {# Redirect mode sets a redirect scheme instead of a backend #} - {% if service_mode == 'redirect' %} - {% if enable_letsencrypt == 'yes' %} +{% endif %} +{% endif %} + {{ "bind %s:%s %s" | e | format(vip_address, service_port, tls_option) | trim() }} +{# Redirect mode sets a redirect scheme instead of a backend #} +{% if service_mode == 'redirect' %} +{% if enable_letsencrypt == 'yes' %} redirect scheme https code 301 if !{ ssl_fc } !{ path_reg ^/.well-known/acme-challenge/.+ } - {% else %} +{% else %} redirect scheme https code 301 if !{ ssl_fc } - {% endif %} - {% for redirect_option in frontend_redirect_extra %} +{% endif %} +{% for redirect_option in frontend_redirect_extra %} {{ redirect_option }} - {% endfor %} - {% else %} +{% endfor %} +{% else %} default_backend {{ service_name }}_back - {% endif %} +{% endif %} {% endmacro %} -{%- macro backend_macro(service_name, listen_port, service_mode, host_group, +{% macro backend_macro(service_name, listen_port, service_mode, host_group, active_passive, custom_member_list, backend_http_extra, backend_tcp_extra, auth_user, auth_pass, tls_backend) %} backend {{ service_name }}_back - {% if service_mode == 'redirect' %} +{% if service_mode == 'redirect' %} mode http - {% else %} +{% else %} mode {{ service_mode }} - {% endif %} - {% if service_mode == 'http' %} - {# Set up auth if required #} - {% if auth_user and auth_pass %} +{% endif %} +{% if service_mode == 'http' %} +{# Set up auth if required #} +{% if auth_user and auth_pass %} acl auth_acl http_auth({{ service_name }}-user) http-request auth realm basicauth unless auth_acl - {% endif %} - {% for http_option in backend_http_extra %} +{% endif %} +{% for http_option in backend_http_extra %} {{ http_option }} - {% endfor %} - {% elif service_mode == 'tcp' %} - {% for tcp_option in backend_tcp_extra %} +{% endfor %} +{% elif service_mode == 'tcp' %} +{% for tcp_option in backend_tcp_extra %} {{ tcp_option }} - {% endfor %} - {% endif %} - {% if custom_member_list is not none %} - {% for custom_member in custom_member_list %} +{% endfor %} +{% endif %} +{% if custom_member_list is not none %} +{% for custom_member in custom_member_list %} {{ custom_member }} - {% endfor %} - {% else %} - {% set backend_tls_info = '' %} - {% if tls_backend|bool %} - {% set haproxy_health_check_final = haproxy_health_check_ssl %} - {% if kolla_verify_tls_backend|bool %} - {% set backend_tls_info = 'ssl verify required ca-file %s'|format(haproxy_backend_cacert) %} - {% else %} - {% set backend_tls_info = 'ssl verify none' %} - {% endif %} - {% else %} - {% set haproxy_health_check_final = haproxy_health_check %} - {% endif %} - {% for host in groups[host_group] %} - {% set host_name = hostvars[host].ansible_facts.hostname %} - {% set host_ip = 'api' | kolla_address(host) %} - {% set service_weight = 'haproxy_' + service_name + '_weight' %} - {% set backend_weight_info = '' %} - {% if hostvars[host][service_weight] is defined and hostvars[host][service_weight] | int != 0 and hostvars[host][service_weight] | int <= 256 %} - {% set backend_weight_info = 'weight %s'|format(hostvars[host][service_weight]) %} - {% endif %} +{% endfor %} +{% else %} +{% set backend_tls_info = '' %} +{% if tls_backend | bool %} +{% set haproxy_health_check_final = haproxy_health_check_ssl %} +{% if kolla_verify_tls_backend | bool %} +{% set backend_tls_info = 'ssl verify required ca-file %s' | format(haproxy_backend_cacert) %} +{% else %} +{% set backend_tls_info = 'ssl verify none' %} +{% endif %} +{% else %} +{% set haproxy_health_check_final = haproxy_health_check %} +{% endif %} +{% for host in groups[host_group] %} +{% set host_name = hostvars[host].ansible_facts.hostname %} +{% set host_ip = 'api' | kolla_address(host) %} +{% set service_weight = 'haproxy_' + service_name + '_weight' %} +{% set backend_weight_info = '' %} +{% if hostvars[host][service_weight] is defined and hostvars[host][service_weight] | int != 0 and hostvars[host][service_weight] | int <= 256 %} +{% set backend_weight_info = 'weight %s' | format(hostvars[host][service_weight]) %} +{% endif %} server {{ host_name }} {{ host_ip }}:{{ listen_port }} {{ haproxy_health_check_final }}{% if active_passive and not loop.first %} backup{% endif %} {{ backend_tls_info }} {{ backend_weight_info }} - {% endfor %} - {% endif %} +{% endfor %} +{% endif %} {% endmacro %} -{%- set haproxy = service.haproxy|default({}) %} -{%- for haproxy_name, haproxy_service in haproxy.items() %} - {# External defaults to false #} - {% set external = haproxy_service.external|default(false)|bool %} - {# Active/passive defaults to false #} - {% set active_passive = haproxy_service.active_passive|default(false)|bool %} - {# Skip anything that is external when the external vip is not enabled #} - {% if haproxy_service.enabled|bool and (not external or haproxy_enable_external_vip|bool)%} - {# Here we define variables and their defaults #} - {# services can be listening on a different port than haproxy #} - {% set listen_port = haproxy_service.listen_port|default(haproxy_service.port) %} - {# Custom member list can use jinja to generate a semicolon separated list #} - {% set custom_member_list = haproxy_service.custom_member_list|default(none) %} - {# Mode defaults to http #} - {% set mode = haproxy_service.mode|default('http') %} - {# By default each service has its own frontend (hence with_frontend is true by default) #} - {% set with_frontend = haproxy_service.with_frontend|default(true)|bool %} - {# By default each service has its own backend (hence with_backend is true by default) #} - {% set with_backend = haproxy_service.with_backend|default(true)|bool %} - {# Use the parent host group but allow it to be overridden #} - {% set host_group = haproxy_service.host_group|default(service.group) %} - {# Additional options can be defined in config, and are additive to the global extras #} - {% set frontend_tcp_extra = haproxy_service.frontend_tcp_extra|default([]) + haproxy_frontend_tcp_extra %} - {% set backend_tcp_extra = haproxy_service.backend_tcp_extra|default([]) + haproxy_backend_tcp_extra %} - {% set frontend_http_extra = haproxy_service.frontend_http_extra|default([]) + haproxy_frontend_http_extra %} - {% set frontend_redirect_extra = haproxy_service.frontend_redirect_extra|default([]) + haproxy_frontend_redirect_extra %} - {% set backend_http_extra = haproxy_service.backend_http_extra|default([]) + haproxy_backend_http_extra %} - {% set tls_backend = haproxy_service.tls_backend|default(false) %} - {# Allow for basic auth #} - {% set auth_user = haproxy_service.auth_user|default() %} - {% set auth_pass = haproxy_service.auth_pass|default() %} - {% if auth_user and auth_pass %} +{% set haproxy = service.haproxy | default({}) %} +{% for haproxy_name, haproxy_service in haproxy.items() %} +{# External defaults to false #} +{% set external = haproxy_service.external | default(false) | bool %} +{# Active/passive defaults to false #} +{% set active_passive = haproxy_service.active_passive | default(false) | bool %} +{# Skip anything that is external when the external vip is not enabled #} +{% if haproxy_service.enabled | bool and (not external or haproxy_enable_external_vip | bool) %} +{# Here we define variables and their defaults #} +{# services can be listening on a different port than haproxy #} +{% set listen_port = haproxy_service.listen_port | default(haproxy_service.port) %} +{# Custom member list can use jinja to generate a semicolon separated list #} +{% set custom_member_list = haproxy_service.custom_member_list | default(none) %} +{# Mode defaults to http #} +{% set mode = haproxy_service.mode | default('http') %} +{# By default each service has its own frontend (hence with_frontend is true by default) #} +{% set with_frontend = haproxy_service.with_frontend | default(true) | bool %} +{# By default each service has its own backend (hence with_backend is true by default) #} +{% set with_backend = haproxy_service.with_backend | default(true) | bool %} +{# Use the parent host group but allow it to be overridden #} +{% set host_group = haproxy_service.host_group | default(service.group) %} +{# Additional options can be defined in config, and are additive to the global extras #} +{% set frontend_tcp_extra = haproxy_service.frontend_tcp_extra | default([]) + haproxy_frontend_tcp_extra %} +{% set backend_tcp_extra = haproxy_service.backend_tcp_extra | default([]) + haproxy_backend_tcp_extra %} +{% set frontend_http_extra = haproxy_service.frontend_http_extra | default([]) + haproxy_frontend_http_extra %} +{% set frontend_redirect_extra = haproxy_service.frontend_redirect_extra | default([]) + haproxy_frontend_redirect_extra %} +{% set backend_http_extra = haproxy_service.backend_http_extra | default([]) + haproxy_backend_http_extra %} +{% set tls_backend = haproxy_service.tls_backend | default(false) %} +{# Allow for basic auth #} +{% set auth_user = haproxy_service.auth_user | default() %} +{% set auth_pass = haproxy_service.auth_pass | default() %} +{% if auth_user and auth_pass %} {{ userlist_macro(haproxy_name, auth_user, auth_pass) }} - {% endif %} - {% if with_frontend %} - {% if not (external|bool and haproxy_single_external_frontend|bool and mode == 'http') %} +{% endif %} +{% if with_frontend %} +{% if not (external | bool and haproxy_single_external_frontend | bool and mode == 'http') %} {{ frontend_macro(haproxy_name, haproxy_service.port, mode, external, frontend_http_extra, frontend_redirect_extra, frontend_tcp_extra) }} - {% endif %} - {% endif %} - {# Redirect (to https) is a special case, as it does not include a backend #} - {% if with_backend and mode != 'redirect' %} +{% endif %} +{% endif %} +{# Redirect (to https) is a special case, as it does not include a backend #} +{% if with_backend and mode != 'redirect' %} {{ backend_macro(haproxy_name, listen_port, mode, host_group, active_passive, custom_member_list, backend_http_extra, backend_tcp_extra, auth_user, auth_pass, tls_backend) }} - {% endif %} - {% endif %} -{%- endfor -%} +{% endif %} +{% endif %} +{% endfor %} diff --git a/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 b/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 index b692c2d6f..1b339959f 100644 --- a/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 +++ b/ansible/roles/heat/templates/wsgi-heat-api-cfn.conf.j2 @@ -1,11 +1,11 @@ {% set heat_log_dir = '/var/log/kolla/heat' %} {% set binary_path = '/var/lib/kolla/venv/bin' %} {% if heat_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ heat_api_cfn_listen_port }} diff --git a/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 b/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 index 1f285dc15..175336f52 100644 --- a/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 +++ b/ansible/roles/heat/templates/wsgi-heat-api.conf.j2 @@ -1,11 +1,11 @@ {% set heat_log_dir = '/var/log/kolla/heat' %} {% set binary_path = '/var/lib/kolla/venv/bin' %} {% if heat_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ heat_api_listen_port }} diff --git a/ansible/roles/horizon/templates/_9998-kolla-settings.py.j2 b/ansible/roles/horizon/templates/_9998-kolla-settings.py.j2 index 4860f0a88..5c4fbd1ab 100644 --- a/ansible/roles/horizon/templates/_9998-kolla-settings.py.j2 +++ b/ansible/roles/horizon/templates/_9998-kolla-settings.py.j2 @@ -33,7 +33,7 @@ OPENSTACK_API_VERSIONS = { } OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = {{ horizon_keystone_multidomain | bool }} -OPENSTACK_KEYSTONE_DOMAIN_DROPDOWN = {{ 'True' if horizon_keystone_domain_choices|length > 1 else 'False' }} +OPENSTACK_KEYSTONE_DOMAIN_DROPDOWN = {{ 'True' if horizon_keystone_domain_choices | length > 1 else 'False' }} OPENSTACK_KEYSTONE_DOMAIN_CHOICES = ( {% for key, value in horizon_keystone_domain_choices.items() %} ('{{ key }}', '{{ value }}'), @@ -45,11 +45,11 @@ SECRET_KEY='{{ horizon_secret_key }}' EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' -{% if multiple_regions_names|length > 1 %} +{% if multiple_regions_names | length > 1 %} AVAILABLE_REGIONS = [ -{% for region_name in multiple_regions_names %} +{% for region_name in multiple_regions_names %} ('{{ keystone_internal_url }}', '{{ region_name }}'), -{% endfor %} +{% endfor %} ] {% endif %} @@ -63,14 +63,14 @@ WEBSSO_ENABLED = True WEBSSO_KEYSTONE_URL = "{{ keystone_public_url }}/v3" WEBSSO_CHOICES = ( ("credentials", _("Keystone Credentials")), - {% for idp in keystone_identity_providers %} + {% for idp in keystone_identity_providers %} ("{{ idp.name }}_{{ idp.protocol }}", "{{ idp.public_name }}"), - {% endfor %} + {% endfor %} ) WEBSSO_IDP_MAPPING = { -{% for idp in keystone_identity_providers %} +{% for idp in keystone_identity_providers %} "{{ idp.name }}_{{ idp.protocol }}": ("{{ idp.name }}", "{{ idp.protocol }}"), -{% endfor %} +{% endfor %} } {% endif %} @@ -139,9 +139,9 @@ POLICY_FILES_PATH = '/etc/openstack-dashboard' AVAILABLE_THEMES = [ ('default', 'Default', 'themes/default'), ('material', 'Material', 'themes/material'), -{% for theme in horizon_custom_themes %} +{% for theme in horizon_custom_themes %} ('{{ theme.name|e }}', '{{ theme.label|e }}', '/etc/openstack-dashboard/themes/{{ theme.name|e }}'), -{% endfor %} +{% endfor %} ] {% endif %} diff --git a/ansible/roles/horizon/templates/horizon.conf.j2 b/ansible/roles/horizon/templates/horizon.conf.j2 index 2f6380da2..8d78f67a4 100644 --- a/ansible/roles/horizon/templates/horizon.conf.j2 +++ b/ansible/roles/horizon/templates/horizon.conf.j2 @@ -1,9 +1,9 @@ {% if horizon_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ horizon_listen_port }} diff --git a/ansible/roles/horizon/templates/horizon.json.j2 b/ansible/roles/horizon/templates/horizon.json.j2 index edbc335f8..9b86503dc 100644 --- a/ansible/roles/horizon/templates/horizon.json.j2 +++ b/ansible/roles/horizon/templates/horizon.json.j2 @@ -52,7 +52,7 @@ "perm": "0600" }{% endif %}{% if horizon_custom_themes | length > 0 %}, { - "source": "{{ container_config_directory}}/themes", + "source": "{{ container_config_directory }}/themes", "dest": "/etc/openstack-dashboard/themes", "owner": "horizon", "perm": "0600" diff --git a/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 b/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 index ecb7a93da..03fce1104 100644 --- a/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 +++ b/ansible/roles/ironic/templates/ironic-api-wsgi.conf.j2 @@ -1,11 +1,11 @@ {% set ironic_log_dir = '/var/log/kolla/ironic' %} {% set wsgi_directory = '/var/lib/kolla/venv/bin' %} {% if ironic_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ ironic_api_listen_port }} diff --git a/ansible/roles/ironic/templates/ironic-dnsmasq.conf.j2 b/ansible/roles/ironic/templates/ironic-dnsmasq.conf.j2 index 5e0a12087..566bfba17 100644 --- a/ansible/roles/ironic/templates/ironic-dnsmasq.conf.j2 +++ b/ansible/roles/ironic/templates/ironic-dnsmasq.conf.j2 @@ -6,12 +6,12 @@ interface={{ ironic_dnsmasq_interface }} bind-interfaces {% for item in ironic_dnsmasq_dhcp_ranges %} -{% set tag = item.tag | default('range_' ~ loop.index) %} -{% set lease_time = item.lease_time | default(ironic_dnsmasq_dhcp_default_lease_time) %} +{% set tag = item.tag | default('range_' ~ loop.index) %} +{% set lease_time = item.lease_time | default(ironic_dnsmasq_dhcp_default_lease_time) %} dhcp-range=set:{{ tag }},{{ item.range }},{{ lease_time }} -{% if item.routers is defined %}dhcp-option=tag:{{ tag }},option:router,{{ item.routers }}{% endif %} -{% if item.ntp_server is defined %}dhcp-option=tag:{{ tag }},option:ntp-server,{{ item.ntp_server }}{% endif %} -{% if item.dns_servers is defined %}dhcp-option=tag:{{ tag }},option:dns-server,{{ item.dns_servers }}{% endif %} +{% if item.routers is defined %}dhcp-option=tag:{{ tag }},option:router,{{ item.routers }}{% endif %} +{% if item.ntp_server is defined %}dhcp-option=tag:{{ tag }},option:ntp-server,{{ item.ntp_server }}{% endif %} +{% if item.dns_servers is defined %}dhcp-option=tag:{{ tag }},option:dns-server,{{ item.dns_servers }}{% endif %} {% endfor %} {% if api_address_family == 'ipv6' %} @@ -21,7 +21,7 @@ dhcp-range=set:{{ tag }},{{ item.range }},{{ lease_time }} dhcp-option=option:tftp-server,{{ ironic_tftp_listen_address }} dhcp-option=option:server-ip-address,{{ ironic_tftp_listen_address }} dhcp-option=210,/var/lib/ironic/tftpboot/ -{% if ironic_dnsmasq_serve_ipxe | bool %} +{% if ironic_dnsmasq_serve_ipxe | bool %} dhcp-match=ipxe,175 dhcp-match=set:efi,option:client-arch,7 dhcp-match=set:efi,option:client-arch,9 @@ -30,7 +30,7 @@ dhcp-option=tag:ipxe,option:bootfile-name,{{ ironic_http_url }}/ipa.ipxe # Client is PXE booting over EFI without iPXE ROM, # send EFI version of iPXE chainloader dhcp-option=tag:efi,tag:!ipxe,option:bootfile-name,{{ ironic_dnsmasq_uefi_ipxe_boot_file }} -{% endif %} +{% endif %} dhcp-option=option:bootfile-name,{{ ironic_dnsmasq_boot_file }} {% endif %}{# ipv6/ipv4 #} diff --git a/ansible/roles/ironic/templates/ironic.conf.j2 b/ansible/roles/ironic/templates/ironic.conf.j2 index 66fbdb1f7..7ed1a9e9d 100644 --- a/ansible/roles/ironic/templates/ironic.conf.j2 +++ b/ansible/roles/ironic/templates/ironic.conf.j2 @@ -23,13 +23,13 @@ rbac_service_role_elevated_access = true [oslo_messaging_notifications] transport_url = {{ notify_transport_url }} {% if ironic_enabled_notification_topics or enable_ironic_prometheus_exporter | bool %} -{% if ironic_enabled_notification_topics %} +{% if ironic_enabled_notification_topics %} driver = messagingv2 topics = {{ ironic_enabled_notification_topics | map(attribute='name') | join(',') }} -{% endif %} -{% if enable_ironic_prometheus_exporter | bool %} +{% endif %} +{% if enable_ironic_prometheus_exporter | bool %} driver = prometheus_exporter -{% endif %} +{% endif %} {% else %} driver = noop {% endif %} @@ -65,11 +65,11 @@ policy_file = {{ ironic_policy_file }} {% if service_name == 'ironic-conductor' %} [conductor] automated_clean=false -{% if enable_ironic_prometheus_exporter | bool %} +{% if enable_ironic_prometheus_exporter | bool %} send_sensor_data = true send_sensor_data_for_undeployed_nodes = {{ ironic_prometheus_exporter_sensor_data_undeployed_nodes }} send_sensor_data_interval = {{ ironic_prometheus_exporter_sensor_data_interval }} -{% endif %} +{% endif %} {% endif %} [database] diff --git a/ansible/roles/keystone/templates/fernet-push.sh.j2 b/ansible/roles/keystone/templates/fernet-push.sh.j2 index 2b0ee6fac..dc07c0390 100644 --- a/ansible/roles/keystone/templates/fernet-push.sh.j2 +++ b/ansible/roles/keystone/templates/fernet-push.sh.j2 @@ -5,21 +5,21 @@ set -o pipefail if [ ! -z "$1" ] && [ "$1" == "--check" ]; then {% if groups['keystone'] | length > 1 %} -{% for host in groups['keystone'] %} -{% if inventory_hostname != host %} +{% for host in groups['keystone'] %} +{% if inventory_hostname != host %} /usr/bin/rsync --dry-run -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ hostvars[host]['keystone_ssh_port'] }} -F /var/lib/keystone/.ssh/config' --delete /etc/keystone/fernet-keys/ keystone@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:/etc/keystone/fernet-keys -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% else %} echo "No additional keystone-server where fernet keys could be rsynced." {% endif %} else {% if groups['keystone'] | length > 1 %} -{% for host in groups['keystone'] %} -{% if inventory_hostname != host %} +{% for host in groups['keystone'] %} +{% if inventory_hostname != host %} /usr/bin/rsync -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ hostvars[host]['keystone_ssh_port'] }} -F /var/lib/keystone/.ssh/config' --delete /etc/keystone/fernet-keys/ keystone@{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:/etc/keystone/fernet-keys -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% else %} echo "No additional keystone-server where fernet keys could be rsynced." {% endif %} diff --git a/ansible/roles/keystone/templates/httpd-keystone.conf.j2 b/ansible/roles/keystone/templates/httpd-keystone.conf.j2 index 435fe7cdd..6d4692367 100644 --- a/ansible/roles/keystone/templates/httpd-keystone.conf.j2 +++ b/ansible/roles/keystone/templates/httpd-keystone.conf.j2 @@ -1,11 +1,11 @@ {% set keystone_log_dir = '/var/log/kolla/keystone' %} {% set binary_path = '/var/lib/kolla/venv/bin' %} {% if keystone_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} {% if kolla_base_distro in ['centos', 'rocky'] %} @@ -49,32 +49,32 @@ LogLevel info SSLEngine on SSLCertificateFile /etc/keystone/certs/keystone-cert.pem SSLCertificateKeyFile /etc/keystone/certs/keystone-key.pem -{% endif -%} +{% endif %} {% if keystone_enable_federation_openid | bool %} -{% if keystone_federation_oidc_forwarded_headers | length > 0 %} +{% if keystone_federation_oidc_forwarded_headers | length > 0 %} OIDCXForwardedHeaders "{{ keystone_federation_oidc_forwarded_headers }}" -{% endif %} +{% endif %} OIDCClaimPrefix "OIDC-" OIDCClaimDelimiter "{{ keystone_federation_oidc_claim_delimiter }}" OIDCResponseType "{{ keystone_federation_oidc_response_type }}" OIDCScope "{{ keystone_federation_oidc_scopes }}" OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }} -{% if keystone_federation_oidc_jwks_uri | length > 0 %} +{% if keystone_federation_oidc_jwks_uri | length > 0 %} OIDCOAuthVerifyJwksUri {{ keystone_federation_oidc_jwks_uri }} -{% endif %} -{% if keystone_federation_openid_certificate_key_ids | length > 0 %} +{% endif %} +{% if keystone_federation_openid_certificate_key_ids | length > 0 %} OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(" ") }} -{% endif %} +{% endif %} OIDCCryptoPassphrase {{ keystone_federation_openid_crypto_password }} OIDCRedirectURI {{ keystone_public_url }}/redirect_uri -{% if enable_memcached | bool and keystone_oidc_enable_memcached | bool %} +{% if enable_memcached | bool and keystone_oidc_enable_memcached | bool %} OIDCCacheType memcache OIDCMemCacheServers "{% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %} {% endif %}{% endfor %}" -{% endif %} -{% for key, value in keystone_federation_oidc_additional_options.items() %} +{% endif %} +{% for key, value in keystone_federation_oidc_additional_options.items() %} {{ key }} {{ value }} -{% endfor %} +{% endfor %} <Location ~ "/redirect_uri"> Require valid-user @@ -87,27 +87,27 @@ LogLevel info AuthType openid-connect </Location> -{% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' %} +{% for idp in keystone_identity_providers %} +{% if idp.protocol == 'openid' %} <LocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso> OIDCDiscoverURL {{ keystone_public_url }}/redirect_uri?iss={{ idp.identifier | urlencode }} Require valid-user AuthType openid-connect </LocationMatch> -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {# CLI / API authentication endpoint -#} -{% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' -%} +{% for idp in keystone_identity_providers %} +{% if idp.protocol == 'openid' %} <LocationMatch /v3/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/auth> Require valid-user {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#} {# additionally handle verifying bearer tokens -#} AuthType auth-openidc </LocationMatch> -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} </VirtualHost> diff --git a/ansible/roles/keystone/templates/keystone.conf.j2 b/ansible/roles/keystone/templates/keystone.conf.j2 index e1b440d48..e5785e000 100644 --- a/ansible/roles/keystone/templates/keystone.conf.j2 +++ b/ansible/roles/keystone/templates/keystone.conf.j2 @@ -91,9 +91,9 @@ allowed_origin = {{ grafana_public_endpoint }} {% if enable_keystone_federation | bool %} [federation] -{% for dashboard in keystone_trusted_dashboards %} +{% for dashboard in keystone_trusted_dashboards %} trusted_dashboard = {{ dashboard }} -{% endfor %} +{% endfor %} sso_callback_template = /etc/keystone/sso_callback_template.html diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 index b94e82557..7364b74f7 100644 --- a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 +++ b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 @@ -1,11 +1,11 @@ {% set keystone_log_dir = '/var/log/kolla/keystone' %} {% set binary_path = '/var/lib/kolla/venv/bin' %} {% if keystone_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ keystone_public_listen_port }} @@ -53,33 +53,33 @@ LogLevel info SSLEngine on SSLCertificateFile /etc/keystone/certs/keystone-cert.pem SSLCertificateKeyFile /etc/keystone/certs/keystone-key.pem -{% endif -%} +{% endif %} {% if keystone_enable_federation_openid | bool %} -{% if keystone_federation_oidc_forwarded_headers | length > 0 %} +{% if keystone_federation_oidc_forwarded_headers | length > 0 %} OIDCXForwardedHeaders "{{ keystone_federation_oidc_forwarded_headers }}" -{% endif %} +{% endif %} OIDCClaimPrefix "OIDC-" OIDCClaimDelimiter "{{ keystone_federation_oidc_claim_delimiter }}" OIDCResponseType "{{ keystone_federation_oidc_response_type }}" OIDCScope "{{ keystone_federation_oidc_scopes }}" OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }} -{% if keystone_federation_oidc_jwks_uri | length > 0 %} +{% if keystone_federation_oidc_jwks_uri | length > 0 %} OIDCOAuthVerifyJwksUri {{ keystone_federation_oidc_jwks_uri }} -{% endif %} +{% endif %} OIDCHTMLErrorTemplate /var/www/html/modoidc-error-page.html -{% if keystone_federation_openid_certificate_key_ids | length > 0 %} +{% if keystone_federation_openid_certificate_key_ids | length > 0 %} OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(" ") }} -{% endif %} +{% endif %} OIDCCryptoPassphrase {{ keystone_federation_openid_crypto_password }} OIDCRedirectURI {{ keystone_public_url }}/redirect_uri -{% if enable_memcached | bool and keystone_oidc_enable_memcached | bool %} +{% if enable_memcached | bool and keystone_oidc_enable_memcached | bool %} OIDCCacheType memcache OIDCMemCacheServers "{% for host in groups['memcached'] %}{{ 'api' | kolla_address(host) | put_address_in_context('memcache') }}:{{ memcached_port }}{% if not loop.last %} {% endif %}{% endfor %}" -{% endif %} -{% for key, value in keystone_federation_oidc_additional_options.items() %} +{% endif %} +{% for key, value in keystone_federation_oidc_additional_options.items() %} {{ key }} {{ value }} -{% endfor %} +{% endfor %} <Location ~ "/redirect_uri"> Require valid-user @@ -92,27 +92,27 @@ LogLevel info AuthType openid-connect </Location> -{% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' %} +{% for idp in keystone_identity_providers %} +{% if idp.protocol == 'openid' %} <LocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso> OIDCDiscoverURL {{ keystone_public_url }}/redirect_uri?iss={{ idp.identifier | urlencode }} Require valid-user AuthType openid-connect </LocationMatch> -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {# CLI / API authentication endpoint -#} -{% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' -%} +{% for idp in keystone_identity_providers %} +{% if idp.protocol == 'openid' %} <LocationMatch /v3/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/auth> Require valid-user {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#} {# additionally handle verifying bearer tokens -#} AuthType auth-openidc </LocationMatch> -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} </VirtualHost> diff --git a/ansible/roles/letsencrypt/templates/letsencrypt-lego-run.sh.j2 b/ansible/roles/letsencrypt/templates/letsencrypt-lego-run.sh.j2 index 19cd8266b..89aa9487b 100644 --- a/ansible/roles/letsencrypt/templates/letsencrypt-lego-run.sh.j2 +++ b/ansible/roles/letsencrypt/templates/letsencrypt-lego-run.sh.j2 @@ -13,14 +13,15 @@ --acme {{ letsencrypt_external_cert_server }} \ --vips {% if not kolla_same_external_internal_vip %}{{ kolla_external_vip_address }},{% endif %}{{ kolla_internal_vip_address }} \ --haproxies-ssh {% for host in groups['loadbalancer'] %}{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ haproxy_ssh_port }}{% if not loop.last %},{% endif %}{% endfor %} \ - {% if letsencrypt_external_account_binding | bool %} + {% if letsencrypt_external_account_binding | bool %} --eab \ --hmac {{ letsencrypt_eab_hmac }} \ --kid {{ letsencrypt_eab_key_id }} \ - {% endif %} - {% if letsencrypt_key_type | length > 0 %} + {% endif %} + {% if letsencrypt_key_type | length > 0 %} --key-type {{ letsencrypt_key_type }} \ - {% endif %} 2>&1 | tee -a /var/log/kolla/letsencrypt/letsencrypt-lego.log + {% endif %} + 2>&1 | tee -a /var/log/kolla/letsencrypt/letsencrypt-lego.log {% endif %} {% if 'internal' in letsencrypt_managed_certs and kolla_internal_fqdn != kolla_internal_vip_address %} @@ -34,14 +35,15 @@ --acme {{ letsencrypt_internal_cert_server }} \ --vips {% if not kolla_same_external_internal_vip %}{{ kolla_external_vip_address }},{% endif %}{{ kolla_internal_vip_address }} \ --haproxies-ssh {% for host in groups['loadbalancer'] %}{{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ haproxy_ssh_port }}{% if not loop.last %},{% endif %}{% endfor %} \ - {% if letsencrypt_external_account_binding | bool %} + {% if letsencrypt_external_account_binding | bool %} --eab \ --hmac {{ letsencrypt_eab_hmac }} \ --kid {{ letsencrypt_eab_key_id }} \ - {% endif %} - {% if letsencrypt_key_type | length > 0 %} + {% endif %} + {% if letsencrypt_key_type | length > 0 %} --key-type {{ letsencrypt_key_type }} \ - {% endif %} 2>&1 | tee -a /var/log/kolla/letsencrypt/letsencrypt-lego.log + {% endif %} + 2>&1 | tee -a /var/log/kolla/letsencrypt/letsencrypt-lego.log {% endif %} {{ cron_cmd }} diff --git a/ansible/roles/loadbalancer/templates/haproxy/haproxy_external_frontend.cfg.j2 b/ansible/roles/loadbalancer/templates/haproxy/haproxy_external_frontend.cfg.j2 index ae9f01d2a..2e626bae4 100644 --- a/ansible/roles/loadbalancer/templates/haproxy/haproxy_external_frontend.cfg.j2 +++ b/ansible/roles/loadbalancer/templates/haproxy/haproxy_external_frontend.cfg.j2 @@ -1,4 +1,4 @@ -{%- set external_tls_bind_info = 'ssl crt /etc/haproxy/certificates/haproxy.pem' if kolla_enable_tls_external|bool else '' %} +{% set external_tls_bind_info = 'ssl crt /etc/haproxy/certificates/haproxy.pem' if kolla_enable_tls_external | bool else '' %} frontend external_frontend mode http diff --git a/ansible/roles/loadbalancer/templates/haproxy/haproxy_main.cfg.j2 b/ansible/roles/loadbalancer/templates/haproxy/haproxy_main.cfg.j2 index 4b4167485..cc7f9737e 100644 --- a/ansible/roles/loadbalancer/templates/haproxy/haproxy_main.cfg.j2 +++ b/ansible/roles/loadbalancer/templates/haproxy/haproxy_main.cfg.j2 @@ -13,9 +13,9 @@ global stats socket /var/lib/kolla/haproxy/haproxy.sock group kolla mode 660{% if haproxy_socket_level_admin | bool %} level admin{% endif %} {% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %} - {% for line in haproxy_ssl_settings.split('\n') %} + {% for line in haproxy_ssl_settings.split('\n') %} {{ line }} - {% endfor %} + {% endfor %} tune.ssl.default-dh-param 4096 ca-base {{ haproxy_backend_cacert_dir }} {% endif %} diff --git a/ansible/roles/loadbalancer/templates/haproxy/haproxy_run.sh.j2 b/ansible/roles/loadbalancer/templates/haproxy/haproxy_run.sh.j2 index 1cb4d0a21..4aa275b1d 100644 --- a/ansible/roles/loadbalancer/templates/haproxy/haproxy_run.sh.j2 +++ b/ansible/roles/loadbalancer/templates/haproxy/haproxy_run.sh.j2 @@ -5,7 +5,7 @@ set -o pipefail set -o xtrace {% if kolla_enable_tls_internal | bool or kolla_enable_tls_external | bool %} -{% if kolla_enable_tls_external | bool %} +{% if kolla_enable_tls_external | bool %} if [ ! -e "/etc/haproxy/certificates/haproxy.pem" ]; then # Generate temporary self-signed cert # This means external tls is enabled but the certificate was not copied @@ -20,8 +20,8 @@ if [ ! -e "/etc/haproxy/certificates/haproxy.pem" ]; then chown haproxy:haproxy /etc/haproxy/certificates/haproxy.pem chmod 0660 /etc/haproxy/certificates/haproxy.pem fi -{% endif %} -{% if kolla_enable_tls_internal | bool %} +{% endif %} +{% if kolla_enable_tls_internal | bool %} if [ ! -e "/etc/haproxy/certificates/haproxy-internal.pem" ]; then # Generate temporary self-signed cert # This means external tls is enabled but the certificate was not copied @@ -36,7 +36,7 @@ if [ ! -e "/etc/haproxy/certificates/haproxy-internal.pem" ]; then chown haproxy:haproxy /etc/haproxy/certificates/haproxy-internal.pem chmod 0660 /etc/haproxy/certificates/haproxy-internal.pem fi -{% endif %} +{% endif %} {% endif %} exec /usr/sbin/haproxy -W -db -p /run/haproxy.pid -f /etc/haproxy/haproxy.cfg -f /etc/haproxy/services.d/ diff --git a/ansible/roles/loadbalancer/templates/keepalived/keepalived.conf.j2 b/ansible/roles/loadbalancer/templates/keepalived/keepalived.conf.j2 index 6ef7d6a82..6b917ed5e 100644 --- a/ansible/roles/loadbalancer/templates/keepalived/keepalived.conf.j2 +++ b/ansible/roles/loadbalancer/templates/keepalived/keepalived.conf.j2 @@ -16,16 +16,16 @@ vrrp_instance kolla_internal_vip_{{ keepalived_virtual_router_id }} { advert_int 1 {% if keepalived_traffic_mode == 'unicast' %} unicast_src_ip {{ api_interface_address }} -{% if groups['loadbalancer'] | length > 1 %} +{% if groups['loadbalancer'] | length > 1 %} unicast_peer { -{% for host in groups['loadbalancer'] %} -{% set ip_addr = 'api' | kolla_address(host) %} -{% if ip_addr != api_interface_address %} +{% for host in groups['loadbalancer'] %} +{% set ip_addr = 'api' | kolla_address(host) %} +{% if ip_addr != api_interface_address %} {{ ip_addr }} -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} } -{% endif %} +{% endif %} {% endif %} virtual_ipaddress { {{ kolla_internal_vip_address }} dev {{ api_interface }} diff --git a/ansible/roles/loadbalancer/templates/proxysql/proxysql.yaml.j2 b/ansible/roles/loadbalancer/templates/proxysql/proxysql.yaml.j2 index fb3fd3c03..f7a8b0a08 100644 --- a/ansible/roles/loadbalancer/templates/proxysql/proxysql.yaml.j2 +++ b/ansible/roles/loadbalancer/templates/proxysql/proxysql.yaml.j2 @@ -79,36 +79,36 @@ mysql_variables: mysql_servers: {% for shard_id, shard in mariadb_shards_info.shards.items() %} -{% set WRITER_GROUP = shard_id | int * 10 %} -{% for host in shard.hosts %} -{% if loop.first %} -{% set WEIGHT = 100 %} -{% else %} -{% set WEIGHT = 10 %} -{% endif %} +{% set _writer_group = shard_id | int * 10 %} +{% for host in shard.hosts %} +{% if loop.first %} +{% set _weight = 100 %} +{% else %} +{% set _weight = 10 %} +{% endif %} - address: "{{ 'api' | kolla_address(host) }}" port : {{ mariadb_port }} - hostgroup : {{ WRITER_GROUP }} + hostgroup : {{ _writer_group }} max_connections: {{ proxysql_backend_max_connections }} max_replication_lag: {{ proxysql_backend_max_replication_lag }} - weight : {{ WEIGHT }} + weight : {{ _weight }} comment : "Writer {{ host }}" -{% if database_enable_tls_backend | bool %} +{% if database_enable_tls_backend | bool %} use_ssl: 1 -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endfor %} mysql_galera_hostgroups: {% for shard_id, shard in mariadb_shards_info.shards.items() %} -{% set WRITER_GROUP = shard_id | int * 10 %} -{% set BACKUP_WRITER_GROUP = WRITER_GROUP | int + 1 %} -{% set READER_GROUP = BACKUP_WRITER_GROUP | int + 1 %} -{% set OFFLINE_GROUP = READER_GROUP | int + 1 %} - - writer_hostgroup: {{ WRITER_GROUP }} - backup_writer_hostgroup: {{ BACKUP_WRITER_GROUP }} - reader_hostgroup: {{ READER_GROUP }} - offline_hostgroup: {{ OFFLINE_GROUP }} +{% set _writer_group = shard_id | int * 10 %} +{% set _backup_writer_group = _writer_group | int + 1 %} +{% set _reader_group = _backup_writer_group | int + 1 %} +{% set _offline_group = _reader_group | int + 1 %} + - writer_hostgroup: {{ _writer_group }} + backup_writer_hostgroup: {{ _backup_writer_group }} + reader_hostgroup: {{ _reader_group }} + offline_hostgroup: {{ _offline_group }} max_connections: {{ proxysql_backend_max_connections }} max_writers: 1 writer_is_also_reader: 0 diff --git a/ansible/roles/manila/templates/manila-share.conf.j2 b/ansible/roles/manila/templates/manila-share.conf.j2 index cade41e82..8665e882a 100644 --- a/ansible/roles/manila/templates/manila-share.conf.j2 +++ b/ansible/roles/manila/templates/manila-share.conf.j2 @@ -1,6 +1,6 @@ [DEFAULT] {% if manila_enabled_backends %} -enabled_share_backends = {{ manila_enabled_backends|map(attribute='name')|join(',') }} +enabled_share_backends = {{ manila_enabled_backends | map(attribute='name') | join(',') }} {% endif %} default_share_type = default_share_type @@ -72,9 +72,9 @@ memcached_servers = {% for host in groups['memcached'] %}{{ 'api' | kolla_addres {% if enable_manila_backend_generic | bool %} [generic] share_driver = manila.share.drivers.generic.GenericShareDriver -{% if neutron_plugin_agent == "openvswitch" %} +{% if neutron_plugin_agent == "openvswitch" %} interface_driver = manila.network.linux.interface.OVSInterfaceDriver -{% endif %} +{% endif %} driver_handles_share_servers = true @@ -114,8 +114,8 @@ hitachi_hnas_file_system_name = {{ hnas_file_system_name }} {% endif %} {% if enable_manila_backend_cephfs_native | bool %} -{% for backend in manila_ceph_backends %} -{% if backend.driver == 'cephfsnative' %} +{% for backend in manila_ceph_backends %} +{% if backend.driver == 'cephfsnative' %} [{{ backend.name }}] driver_handles_share_servers = false share_backend_name = {{ backend.share_name }} @@ -123,16 +123,16 @@ share_driver = manila.share.drivers.cephfs.driver.CephFSDriver cephfs_conf_path = /etc/ceph/{{ backend.cluster }}.conf cephfs_auth_id = {{ ceph_manila_user }} cephfs_cluster_name = {{ backend.cluster }} -{% if manila_cephfs_filesystem_name | length %} +{% if manila_cephfs_filesystem_name | length %} cephfs_filesystem_name = {{ manila_cephfs_filesystem_name }} -{% endif %} -{% endif %} -{% endfor %} +{% endif %} +{% endif %} +{% endfor %} {% endif %} {% if enable_manila_backend_cephfs_nfs | bool %} -{% for backend in manila_ceph_backends %} -{% if backend.driver == 'cephfsnfs' %} +{% for backend in manila_ceph_backends %} +{% if backend.driver == 'cephfsnfs' %} [{{ backend.name }}] driver_handles_share_servers = false share_backend_name = {{ backend.share_name }} @@ -141,13 +141,13 @@ cephfs_protocol_helper_type = NFS cephfs_conf_path = /etc/ceph/{{ backend.cluster }}.conf cephfs_auth_id = {{ ceph_manila_user }} cephfs_cluster_name = {{ backend.cluster }} -{% if manila_cephfs_filesystem_name | length %} +{% if manila_cephfs_filesystem_name | length %} cephfs_filesystem_name = {{ manila_cephfs_filesystem_name }} -{% endif %} +{% endif %} cephfs_ganesha_server_is_remote= false cephfs_ganesha_server_ip = {{ api_interface_address }} -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_manila_backend_glusterfs_nfs | bool %} @@ -157,17 +157,23 @@ share_backend_name = GLUSTERFSNFS1 share_driver = manila.share.drivers.glusterfs.GlusterfsShareDriver glusterfs_share_layout = {{ manila_glusterfs_share_layout }} glusterfs_nfs_server_type = {{ manila_glusterfs_nfs_server_type }} -{% if manila_glusterfs_servers is defined %} +{% if manila_glusterfs_servers is defined %} glusterfs_servers = {% for ip in manila_glusterfs_servers %}{% if manila_glusterfs_ssh_user is defined %}{{ manila_glusterfs_ssh_user }}@{% endif %}{{ ip }}{% if not loop.last %},{% endif %}{% endfor %} -{% endif %} -{% if manila_glusterfs_volume_pattern is defined %}glusterfs_volume_pattern = {{ manila_glusterfs_volume_pattern }}{% endif %} - -{% if manila_glusterfs_target is defined %}glusterfs_target = {{ manila_glusterfs_target }}{% endif %} - -{% if manila_glusterfs_mount_point_base is defined %}glusterfs_mount_point_base = {{ manila_glusterfs_mount_point_base }}{% endif %} - -{% if manila_glusterfs_ssh_password is defined %}glusterfs_server_password = {{ manila_glusterfs_ssh_password }}{% endif %} +{% endif %} +{% if manila_glusterfs_volume_pattern is defined %} +glusterfs_volume_pattern = {{ manila_glusterfs_volume_pattern }} +{% endif %} +{% if manila_glusterfs_target is defined %} +glusterfs_target = {{ manila_glusterfs_target }} +{% endif %} +{% if manila_glusterfs_mount_point_base is defined %} +glusterfs_mount_point_base = {{ manila_glusterfs_mount_point_base }} +{% endif %} + +{% if manila_glusterfs_ssh_password is defined %} +glusterfs_server_password = {{ manila_glusterfs_ssh_password }} +{% endif %} {% endif %} [oslo_concurrency] diff --git a/ansible/roles/mariadb/templates/galera.cnf.j2 b/ansible/roles/mariadb/templates/galera.cnf.j2 index e61ba9f6a..dcb84fcdf 100644 --- a/ansible/roles/mariadb/templates/galera.cnf.j2 +++ b/ansible/roles/mariadb/templates/galera.cnf.j2 @@ -1,4 +1,4 @@ -{%- set wsrep_driver = '/usr/lib/galera/libgalera_smm.so' if kolla_base_distro in ['debian', 'ubuntu'] else '/usr/lib64/galera/libgalera_smm.so' %} +{% set wsrep_driver = '/usr/lib/galera/libgalera_smm.so' if kolla_base_distro in ['debian', 'ubuntu'] else '/usr/lib64/galera/libgalera_smm.so' %} [client] default-character-set=utf8 diff --git a/ansible/roles/masakari/templates/masakari-monitors.conf.j2 b/ansible/roles/masakari/templates/masakari-monitors.conf.j2 index f52afd503..e63d8e7fb 100644 --- a/ansible/roles/masakari/templates/masakari-monitors.conf.j2 +++ b/ansible/roles/masakari/templates/masakari-monitors.conf.j2 @@ -33,13 +33,13 @@ restrict_to_remotes = true See https://bugs.launchpad.net/masakari-monitors/+bug/1933203 #} disable_ipmi_check = true -{% if inventory_hostname in groups['hacluster'] %} +{% if inventory_hostname in groups['hacluster'] %} pacemaker_node_type = cluster corosync_multicast_interfaces = {{ api_interface }} corosync_multicast_ports = {{ hacluster_corosync_port }} -{% elif inventory_hostname in groups['hacluster-remote'] %} +{% elif inventory_hostname in groups['hacluster-remote'] %} pacemaker_node_type = remote -{% endif %} +{% endif %} {% endif %} [oslo_concurrency] diff --git a/ansible/roles/masakari/templates/masakari.conf.j2 b/ansible/roles/masakari/templates/masakari.conf.j2 index d3f6a8721..37832a33e 100644 --- a/ansible/roles/masakari/templates/masakari.conf.j2 +++ b/ansible/roles/masakari/templates/masakari.conf.j2 @@ -84,13 +84,13 @@ connection = mysql+pymysql://{{ masakari_database_user }}:{{ masakari_database_p {% if service_name == 'masakari-api' %} [coordination] -{% if masakari_coordination_backend == 'valkey' %} +{% if masakari_coordination_backend == 'valkey' %} backend_url = {{ valkey_connection_string }} -{% elif masakari_coordination_backend == 'etcd' %} +{% elif masakari_coordination_backend == 'etcd' %} # NOTE(jan.gutter): etcd v3.4 removed the default `v3alpha` api_version. Until # tooz defaults to a newer version, we should explicitly specify `v3` backend_url = etcd3+{{ internal_protocol }}://{{ kolla_internal_fqdn }}:{{ etcd_client_port }}?api_version=v3{% if openstack_cacert %}?ca_cert={{ openstack_cacert }}{% endif %} -{% endif %} +{% endif %} {% endif %} [oslo_concurrency] diff --git a/ansible/roles/neutron/templates/l3_agent.ini.j2 b/ansible/roles/neutron/templates/l3_agent.ini.j2 index 32b0a984c..0422b4d24 100644 --- a/ansible/roles/neutron/templates/l3_agent.ini.j2 +++ b/ansible/roles/neutron/templates/l3_agent.ini.j2 @@ -1,12 +1,12 @@ #jinja2: trim_blocks: False -{% set vpn_device_driver = 'neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver' if kolla_base_distro in ['ubuntu', 'debian'] else 'neutron_vpnaas.services.vpn.device_drivers.libreswan_ipsec.LibreSwanDriver'%} +{% set vpn_device_driver = 'neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver' if kolla_base_distro in ['ubuntu', 'debian'] else 'neutron_vpnaas.services.vpn.device_drivers.libreswan_ipsec.LibreSwanDriver' %} [DEFAULT] {% if enable_neutron_dvr | bool %} -{% if inventory_hostname in groups['network'] %} +{% if inventory_hostname in groups['network'] %} agent_mode = dvr_snat -{% else %} +{% else %} agent_mode = {{ neutron_compute_dvr_mode }} -{% endif %} +{% endif %} {% else %} agent_mode = legacy {% endif %} diff --git a/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 b/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 index 3a141e554..df4abca8c 100644 --- a/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 +++ b/ansible/roles/neutron/templates/neutron-l3-agent-wrapper.sh.j2 @@ -3,16 +3,16 @@ set -o errexit {% if not neutron_agents_wrappers | bool %} -{% if enable_neutron_agent_ha | bool %} +{% if enable_neutron_agent_ha | bool %} # NOTE(jeffrey4l): Remove all l3 related netns in case of multiple active routers in l3 high available mode. neutron-netns-cleanup \ --config-file /etc/neutron/neutron.conf \ --config-file /etc/neutron/l3_agent.ini \ -{% if enable_neutron_fwaas | bool %} +{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini \ -{% endif %} +{% endif %} --force --agent-type l3 -{% endif %} +{% endif %} {% endif %} neutron-l3-agent \ diff --git a/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 b/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 index 33c638547..880d8aa44 100644 --- a/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 +++ b/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 @@ -15,14 +15,16 @@ "perm": "0600" }, {% endif %} -{% if check_extra_ml2_plugins is defined and check_extra_ml2_plugins.matched > 0 %}{% for plugin in check_extra_ml2_plugins.files %} +{% if check_extra_ml2_plugins is defined and check_extra_ml2_plugins.matched > 0 %} +{% for plugin in check_extra_ml2_plugins.files %} { "source": "{{ container_config_directory }}/{{ plugin.path | basename }}", "dest": "/etc/neutron/plugins/ml2/{{ plugin.path | basename }}", "owner": "neutron", "perm": "0600" }, -{% endfor %}{% endif %} +{% endfor %} +{% endif %} {% if neutron_policy_file is defined %}{ "source": "{{ container_config_directory }}/{{ neutron_policy_file }}", "dest": "/etc/neutron/{{ neutron_policy_file }}", diff --git a/ansible/roles/neutron/templates/neutron.conf.j2 b/ansible/roles/neutron/templates/neutron.conf.j2 index 0c5323d7e..55fa0bcba 100644 --- a/ansible/roles/neutron/templates/neutron.conf.j2 +++ b/ansible/roles/neutron/templates/neutron.conf.j2 @@ -33,7 +33,7 @@ host = {{ ansible_facts.hostname }}_{{ item }} {% endif %} core_plugin = ml2 -service_plugins = {{ neutron_service_plugins|map(attribute='name')|join(',') }} +service_plugins = {{ neutron_service_plugins | map(attribute='name') | join(',') }} {% if enable_neutron_agent_ha | bool %} dhcp_agents_per_network = {{ dhcp_agents_per_network }} diff --git a/ansible/roles/neutron/templates/openvswitch_agent.ini.j2 b/ansible/roles/neutron/templates/openvswitch_agent.ini.j2 index f908c7f14..5c7efacd4 100644 --- a/ansible/roles/neutron/templates/openvswitch_agent.ini.j2 +++ b/ansible/roles/neutron/templates/openvswitch_agent.ini.j2 @@ -7,7 +7,7 @@ arp_responder = true enable_distributed_routing = true {% endif %} {% if neutron_agent_extensions %} -extensions = {{ neutron_agent_extensions|map(attribute='name')|join(',') }} +extensions = {{ neutron_agent_extensions | map(attribute='name') | join(',') }} {% endif %} [securitygroup] diff --git a/ansible/roles/nova-cell/templates/nova.conf.d/libvirt.conf.j2 b/ansible/roles/nova-cell/templates/nova.conf.d/libvirt.conf.j2 index 87e0bf977..2661bf433 100644 --- a/ansible/roles/nova-cell/templates/nova.conf.d/libvirt.conf.j2 +++ b/ansible/roles/nova-cell/templates/nova.conf.d/libvirt.conf.j2 @@ -13,9 +13,9 @@ images_rbd_pool = {{ nova_cell_ceph_backend['vms']['pool'] }} images_rbd_ceph_conf = /etc/ceph/{{ nova_cell_ceph_backend['cluster'] }}.conf rbd_user = {{ nova_cell_ceph_backend['vms']['user'] }} disk_cachemodes="network=writeback" -{% if nova_hw_disk_discard != '' %} +{% if nova_hw_disk_discard != '' %} hw_disk_discard = {{ nova_hw_disk_discard }} -{% endif %} +{% endif %} {% endif %} {% if nova_backend == "rbd" and external_ceph_cephx_enabled | bool %} rbd_secret_uuid = {{ rbd_secret_uuid }} diff --git a/ansible/roles/nova-cell/templates/nova.conf.j2 b/ansible/roles/nova-cell/templates/nova.conf.j2 index 6e8877950..5e98a8c9f 100644 --- a/ansible/roles/nova-cell/templates/nova.conf.j2 +++ b/ansible/roles/nova-cell/templates/nova.conf.j2 @@ -27,9 +27,9 @@ my_ip = {{ api_interface_address }} {% if enable_ceilometer | bool %} instance_usage_audit = true instance_usage_audit_period = hour -{% if enable_watcher | bool %} +{% if enable_watcher | bool %} compute_monitors=nova.compute.monitors.cpu.virt_driver -{% endif %} +{% endif %} {% endif %} transport_url = {{ nova_cell_rpc_transport_url }} @@ -44,17 +44,17 @@ workers = {{ nova_cell_conductor_workers }} {% if nova_console == 'novnc' %} [vnc] -{% if service_name == "nova-compute-ironic" %} +{% if service_name == "nova-compute-ironic" %} enabled = false -{% else %} +{% else %} novncproxy_host = {{ api_interface_address }} novncproxy_port = {{ nova_novncproxy_listen_port }} server_listen = {{ api_interface_address }} server_proxyclient_address = {{ api_interface_address }} -{% if inventory_hostname in groups[nova_cell_compute_group] %} +{% if inventory_hostname in groups[nova_cell_compute_group] %} novncproxy_base_url = {{ nova_novncproxy_fqdn | kolla_url(public_protocol, nova_novncproxy_public_port, '/vnc_lite.html') }} -{% endif %} -{% endif %} +{% endif %} +{% endif %} {% elif nova_console == 'spice' %} [vnc] # We have to turn off vnc to use spice @@ -63,9 +63,9 @@ enabled = false enabled = true server_listen = {{ api_interface_address }} server_proxyclient_address = {{ api_interface_address }} -{% if inventory_hostname in groups[nova_cell_compute_group] %} +{% if inventory_hostname in groups[nova_cell_compute_group] %} html5proxy_base_url = {{ nova_spicehtml5proxy_fqdn | kolla_url(public_protocol, nova_spicehtml5proxy_public_port, '/spice_auto.html') }} -{% endif %} +{% endif %} html5proxy_host = {{ api_interface_address }} html5proxy_port = {{ nova_spicehtml5proxy_listen_port }} {% elif nova_console == 'none' %} @@ -141,21 +141,21 @@ max_overflow = 1000 max_pool_size = {{ database_max_pool_size }} max_retries = -1 -{% if service_name == 'nova-cell-bootstrap' or (service_name == 'nova-conductor' and nova_cell_conductor_has_api_database | bool) %} +{% if service_name == 'nova-cell-bootstrap' or (service_name == 'nova-conductor' and nova_cell_conductor_has_api_database | bool) %} [api_database] connection = mysql+pymysql://{{ nova_api_database_user }}:{{ nova_api_database_password }}@{{ nova_api_database_address }}/{{ nova_api_database_name }}{{ '?ssl_ca=' ~ openstack_cacert if nova_cell_database_enable_tls_internal | bool }} connection_recycle_time = {{ database_connection_recycle_time }} max_pool_size = {{ database_max_pool_size }} max_retries = -1 -{% endif %} +{% endif %} {% endif %} {% if service_name == 'nova-compute' %} -{% if nova_compute_virt_type in ['kvm', 'qemu'] %} +{% if nova_compute_virt_type in ['kvm', 'qemu'] %} {# must be an include because Ansible 2.8 (and earlier) does not like defined variables referencing undefined variables: migration_interface_address here #} {# see https://github.com/ansible/ansible/issues/58835 #} -{% include 'nova.conf.d/libvirt.conf.j2' %} -{% endif %} +{% include 'nova.conf.d/libvirt.conf.j2' %} +{% endif %} {% endif %} [upgrade_levels] diff --git a/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 b/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 index aeea3e932..79f6956fd 100644 --- a/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 +++ b/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 @@ -1,11 +1,11 @@ {% set nova_log_dir = '/var/log/kolla/nova' %} {% set wsgi_directory = '/var/lib/kolla/venv/bin' %} {% if nova_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ nova_api_listen_port }} diff --git a/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 b/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 index 8519ebf33..471baac84 100644 --- a/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 +++ b/ansible/roles/nova/templates/nova-metadata-wsgi.conf.j2 @@ -1,11 +1,11 @@ {% set nova_log_dir = '/var/log/kolla/nova' %} {% set wsgi_directory = '/var/lib/kolla/venv/bin' %} {% if nova_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ nova_metadata_listen_port }} diff --git a/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 b/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 index f4203c1c8..d7fa10ac3 100644 --- a/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 +++ b/ansible/roles/octavia/templates/octavia-wsgi.conf.j2 @@ -1,10 +1,10 @@ {% set wsgi_directory = '/var/lib/kolla/venv/bin' %} {% if octavia_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ octavia_api_listen_port }} diff --git a/ansible/roles/octavia/templates/octavia.conf.j2 b/ansible/roles/octavia/templates/octavia.conf.j2 index 9f251ffa9..8a145d6a3 100644 --- a/ansible/roles/octavia/templates/octavia.conf.j2 +++ b/ansible/roles/octavia/templates/octavia.conf.j2 @@ -89,18 +89,18 @@ amp_ssh_key_name = {{ octavia_amp_ssh_key_name }} amp_image_tag = {{ octavia_amp_image_tag }} {% if not octavia_auto_configure | bool %} -{% if octavia_amp_image_owner_id is defined %} +{% if octavia_amp_image_owner_id is defined %} amp_image_owner_id = {{ octavia_amp_image_owner_id }} -{% endif %} -{% if octavia_amp_boot_network_list is defined %} +{% endif %} +{% if octavia_amp_boot_network_list is defined %} amp_boot_network_list = {{ octavia_amp_boot_network_list }} -{% endif %} -{% if octavia_amp_secgroup_list is defined %} +{% endif %} +{% if octavia_amp_secgroup_list is defined %} amp_secgroup_list = {{ octavia_amp_secgroup_list }} -{% endif %} -{% if octavia_amp_flavor_id is defined %} +{% endif %} +{% if octavia_amp_flavor_id is defined %} amp_flavor_id = {{ octavia_amp_flavor_id }} -{% endif %} +{% endif %} {% else %} amp_image_owner_id = {{ project_info.projects.0.id }} amp_boot_network_list = {{ network_info.id }} diff --git a/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 b/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 index c1809aed1..19925bae5 100644 --- a/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 +++ b/ansible/roles/placement/templates/placement-api-wsgi.conf.j2 @@ -1,11 +1,11 @@ {% set log_dir = '/var/log/kolla/placement' %} {% set wsgi_directory = '/var/lib/kolla/venv/bin' %} {% if placement_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos', 'rocky'] %} +{% if kolla_base_distro in ['centos', 'rocky'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ placement_api_listen_port }} diff --git a/ansible/roles/prometheus/templates/prometheus.yml.j2 b/ansible/roles/prometheus/templates/prometheus.yml.j2 index 6176a4b33..1aa75fa2c 100644 --- a/ansible/roles/prometheus/templates/prometheus.yml.j2 +++ b/ansible/roles/prometheus/templates/prometheus.yml.j2 @@ -4,16 +4,16 @@ global: evaluation_interval: 15s {% if prometheus_external_labels %} external_labels: -{% for label, value in prometheus_external_labels.items() %} +{% for label, value in prometheus_external_labels.items() %} {{ label }}: {{ value }} -{% endfor %} +{% endfor %} {% endif %} {% if prometheus_alert_rules.files is defined and prometheus_alert_rules.files | length > 0 %} rule_files: -{% for rule in prometheus_alert_rules.files %} +{% for rule in prometheus_alert_rules.files %} - "/etc/prometheus/{{ rule.path | basename }}" -{% endfor %} +{% endfor %} {% endif %} scrape_configs: @@ -25,108 +25,108 @@ scrape_configs: {% for host in groups['prometheus'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ prometheus_port }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} +{% endif %} {% endfor %} {% if enable_prometheus_node_exporter | bool %} - job_name: node static_configs: -{% for host in groups['prometheus-node-exporter'] %} +{% for host in groups['prometheus-node-exporter'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_node_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} -{% for target in prometheus_node_exporter_targets_extra %} +{% endif %} +{% endfor %} +{% for target in prometheus_node_exporter_targets_extra %} - targets: - '{{ target.target }}' -{% if target.labels | default({}, true) %} +{% if target.labels | default({}, true) %} labels: {{ target.labels | to_json }} -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_mysqld_exporter | bool %} - job_name: mysqld static_configs: -{% for host in groups['prometheus-mysqld-exporter'] %} +{% for host in groups['prometheus-mysqld-exporter'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_mysqld_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_haproxy_exporter | bool %} - job_name: haproxy static_configs: -{% for host in groups['loadbalancer'] %} +{% for host in groups['loadbalancer'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ prometheus_haproxy_exporter_port }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_rabbitmq_exporter | bool %} - job_name: rabbitmq static_configs: -{% for host in groups['rabbitmq'] %} +{% for host in groups['rabbitmq'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_rabbitmq_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_memcached_exporter | bool %} - job_name: memcached static_configs: -{% for host in groups['prometheus-memcached-exporter'] %} +{% for host in groups['prometheus-memcached-exporter'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_memcached_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_cadvisor | bool %} - job_name: cadvisor static_configs: -{% for host in groups["prometheus-cadvisor"] %} +{% for host in groups["prometheus-cadvisor"] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_cadvisor_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_fluentd_integration | bool %} - job_name: fluentd static_configs: -{% for host in groups['fluentd'] %} +{% for host in groups['fluentd'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_fluentd_integration_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_ceph_mgr_exporter | bool %} @@ -135,18 +135,18 @@ scrape_configs: scrape_interval: {{ prometheus_ceph_exporter_interval }} static_configs: - targets: -{% for exporter in prometheus_ceph_mgr_exporter_endpoints %} +{% for exporter in prometheus_ceph_mgr_exporter_endpoints %} - '{{ exporter }}' -{% endfor %} +{% endfor %} {% endif %} {% if enable_prometheus_openstack_exporter | bool %} - job_name: openstack_exporter scrape_interval: {{ prometheus_openstack_exporter_interval }} scrape_timeout: {{ prometheus_openstack_exporter_timeout }} -{% if kolla_enable_tls_internal | bool %} +{% if kolla_enable_tls_internal | bool %} scheme: https -{% endif %} +{% endif %} honor_labels: true static_configs: - targets: @@ -157,14 +157,14 @@ scrape_configs: - job_name: elasticsearch_exporter scrape_interval: {{ prometheus_elasticsearch_exporter_interval }} static_configs: -{% for host in groups["prometheus-elasticsearch-exporter"] %} +{% for host in groups["prometheus-elasticsearch-exporter"] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_elasticsearch_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_blackbox_exporter | bool and prometheus_blackbox_exporter_endpoints | length > 0 | bool %} @@ -173,9 +173,9 @@ scrape_configs: honor_labels: true static_configs: - targets: -{% for target in prometheus_blackbox_exporter_endpoints %} +{% for target in prometheus_blackbox_exporter_endpoints %} - '{{ target }}' -{% endfor %} +{% endfor %} relabel_configs: - source_labels: [__address__] regex: ([^:]+):([^:]+):(.+) @@ -202,79 +202,79 @@ scrape_configs: scrape_interval: {{ prometheus_libvirt_exporter_interval }} honor_labels: true static_configs: -{% for host in groups["prometheus-libvirt-exporter"] %} +{% for host in groups["prometheus-libvirt-exporter"] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_libvirt_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_etcd_integration | bool %} - job_name: etcd -{% if etcd_enable_tls | bool %} +{% if etcd_enable_tls | bool %} scheme: https -{% endif %} +{% endif %} static_configs: -{% for host in groups["etcd"] %} +{% for host in groups["etcd"] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_etcd_integration_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_ironic_prometheus_exporter | bool %} - job_name: ironic_prometheus_exporter static_configs: -{% for host in groups['ironic-conductor'] %} +{% for host in groups['ironic-conductor'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['ironic_prometheus_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} {% if enable_prometheus_alertmanager | bool %} - job_name: alertmanager static_configs: -{% for host in groups['prometheus-alertmanager'] %} +{% for host in groups['prometheus-alertmanager'] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_alertmanager_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} -{% if enable_prometheus_proxysql_exporter | bool %} +{% if enable_prometheus_proxysql_exporter | bool %} - job_name: proxysql static_configs: -{% for host in groups["loadbalancer"] %} +{% for host in groups["loadbalancer"] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['proxysql_prometheus_exporter_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} -{% endif %} +{% endif %} +{% endfor %} +{% endif %} alerting: alertmanagers: - static_configs: -{% for host in groups["prometheus-alertmanager"] %} +{% for host in groups["prometheus-alertmanager"] %} - targets: - '{{ 'api' | kolla_address(host, override_var='prometheus_target_address') | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_alertmanager_port'] }}' -{% if hostvars[host].prometheus_instance_label | default(false, true) %} +{% if hostvars[host].prometheus_instance_label | default(false, true) %} labels: instance: "{{ hostvars[host].prometheus_instance_label }}" -{% endif %} -{% endfor %} +{% endif %} +{% endfor %} {% endif %} diff --git a/ansible/roles/proxysql-config/templates/rules.yaml.j2 b/ansible/roles/proxysql-config/templates/rules.yaml.j2 index c4ff11e4e..764febbe0 100644 --- a/ansible/roles/proxysql-config/templates/rules.yaml.j2 +++ b/ansible/roles/proxysql-config/templates/rules.yaml.j2 @@ -10,17 +10,17 @@ # https://proxysql.com/documentation/main-runtime/#mysql_query_rules mysql_query_rules: {% for rule in proxysql_project_database_shard['rules'] %} -{% set WRITER_GROUP = rule['shard_id'] | int * 10 %} -{% if rule['schema'] is defined %} +{% set _writer_group = rule['shard_id'] | int * 10 %} +{% if rule['schema'] is defined %} - schemaname: "{{ rule['schema'] }}" - destination_hostgroup: {{ WRITER_GROUP }} + destination_hostgroup: {{ _writer_group }} apply: 1 active: 1 -{% endif %} -{% if rule['user'] is defined %} +{% endif %} +{% if rule['user'] is defined %} - username: "{{ rule['user'] }}" - destination_hostgroup: {{ WRITER_GROUP }} + destination_hostgroup: {{ _writer_group }} apply: 1 active: 1 -{% endif %} +{% endif %} {% endfor %} diff --git a/ansible/roles/proxysql-config/templates/users.yaml.j2 b/ansible/roles/proxysql-config/templates/users.yaml.j2 index f8de57bc8..02a2ee19b 100644 --- a/ansible/roles/proxysql-config/templates/users.yaml.j2 +++ b/ansible/roles/proxysql-config/templates/users.yaml.j2 @@ -15,14 +15,14 @@ mysql_users: {% for user in proxysql_project_database_shard['users'] %} -{% if user['shard_id'] is defined %} -{% set WRITER_GROUP = user['shard_id'] | int * 10 %} -{% endif %} +{% if user['shard_id'] is defined %} +{% set _writer_group = user['shard_id'] | int * 10 %} +{% endif %} - username: "{{ user['user'] }}" password: "{{ user['password'] }}" -{% if user['shard_id'] is defined %} - default_hostgroup: {{ WRITER_GROUP }} -{% endif %} +{% if user['shard_id'] is defined %} + default_hostgroup: {{ _writer_group }} +{% endif %} transaction_persistent: 1 active: 1 {% endfor %} diff --git a/ansible/roles/rabbitmq/templates/advanced.config.j2 b/ansible/roles/rabbitmq/templates/advanced.config.j2 index d83b6742a..2e518f715 100644 --- a/ansible/roles/rabbitmq/templates/advanced.config.j2 +++ b/ansible/roles/rabbitmq/templates/advanced.config.j2 @@ -1,3 +1,4 @@ +{# j2lint: disable=single-space-decorator #} [ {kernel, [ {inet_dist_use_interface, {% raw %}{{% endraw %}{{ api_interface_address | put_address_in_context('rabbitmq') }}}}, diff --git a/ansible/roles/rabbitmq/templates/rabbitmq.conf.j2 b/ansible/roles/rabbitmq/templates/rabbitmq.conf.j2 index 340f5ef3f..1722de3e9 100644 --- a/ansible/roles/rabbitmq/templates/rabbitmq.conf.j2 +++ b/ansible/roles/rabbitmq/templates/rabbitmq.conf.j2 @@ -29,9 +29,9 @@ cluster_formation.classic_config.nodes.{{ loop.index0 }} = rabbit@{{ hostvars[ho # https://www.rabbitmq.com/ssl.html ssl_options.certfile = /etc/rabbitmq/certs/{{ project_name }}-cert.pem ssl_options.keyfile = /etc/rabbitmq/certs/{{ project_name }}-key.pem -{% for key, value in rabbitmq_tls_options.items() %} +{% for key, value in rabbitmq_tls_options.items() %} ssl_options.{{ key }} = {{ value }} -{% endfor %} +{% endfor %} {% endif %} {% if 'rabbitmq_prometheus' in rabbitmq_enabled_plugins | map(attribute='name') %} diff --git a/ansible/roles/skyline/templates/skyline-console.json.j2 b/ansible/roles/skyline/templates/skyline-console.json.j2 index 3cab04905..ee64205b7 100644 --- a/ansible/roles/skyline/templates/skyline-console.json.j2 +++ b/ansible/roles/skyline/templates/skyline-console.json.j2 @@ -14,7 +14,7 @@ "perm": "0600" }{% if skyline_custom_logos | length > 0 %}, { - "source": "{{ container_config_directory}}/logos", + "source": "{{ container_config_directory }}/logos", "dest": "/var/lib/kolla/venv/lib/python3/site-packages/skyline_console/static", "owner": "root", "perm": "0644", diff --git a/ansible/roles/skyline/templates/skyline.yaml.j2 b/ansible/roles/skyline/templates/skyline.yaml.j2 index ad7fe09ae..9d0ae0741 100644 --- a/ansible/roles/skyline/templates/skyline.yaml.j2 +++ b/ansible/roles/skyline/templates/skyline.yaml.j2 @@ -16,12 +16,12 @@ default: openstack: {% if skyline_base_domains_ignore | bool %} base_domains: -{% if enable_heat | bool %} +{% if enable_heat | bool %} - heat_user_domain -{% endif %} -{% if enable_magnum | bool %} +{% endif %} +{% if enable_magnum | bool %} - magnum -{% endif %} +{% endif %} {% endif %} default_region: {{ openstack_region_name }} extension_mapping: diff --git a/ansible/roles/telegraf/templates/telegraf.conf.j2 b/ansible/roles/telegraf/templates/telegraf.conf.j2 index a890bf104..67dcfcdac 100644 --- a/ansible/roles/telegraf/templates/telegraf.conf.j2 +++ b/ansible/roles/telegraf/templates/telegraf.conf.j2 @@ -12,7 +12,7 @@ hostname = "" omit_hostname = false {% if enable_influxdb | bool %} -{% for host in groups['influxdb'] %} +{% for host in groups['influxdb'] %} [[outputs.influxdb]] urls = ["{{ influxdb_proto }}://{{ 'api' | kolla_address(host) }}:{{ influxdb_http_port }}"] database = "telegraf" # required @@ -20,7 +20,7 @@ write_consistency = "any" timeout = "5s" tls_ca = "{{ openstack_cacert }}" -{% endfor %} +{% endfor %} {% endif %} [[inputs.cpu]] percpu = true diff --git a/ansible/roles/trove/templates/trove-wsgi.conf.j2 b/ansible/roles/trove/templates/trove-wsgi.conf.j2 index 3d79d04e7..f623704bb 100644 --- a/ansible/roles/trove/templates/trove-wsgi.conf.j2 +++ b/ansible/roles/trove/templates/trove-wsgi.conf.j2 @@ -1,10 +1,10 @@ {% set wsgi_directory = '/var/lib/kolla/venv/bin' %} {% if trove_enable_tls_backend | bool %} -{% if kolla_base_distro in ['centos'] %} +{% if kolla_base_distro in ['centos'] %} LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so -{% else %} +{% else %} LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so -{% endif %} +{% endif %} {% endif %} Listen {{ api_interface_address | put_address_in_context('url') }}:{{ trove_api_listen_port }} diff --git a/ansible/roles/valkey/templates/valkey-server.conf.j2 b/ansible/roles/valkey/templates/valkey-server.conf.j2 index b1b94af0d..a06e0b044 100644 --- a/ansible/roles/valkey/templates/valkey-server.conf.j2 +++ b/ansible/roles/valkey/templates/valkey-server.conf.j2 @@ -8,22 +8,22 @@ port {{ valkey_server_port }} {# TODO(mnasiadka): Remove after Gazpacho/2026.1 #} {% if _valkey_migration | default(false) | bool %} protected-mode no -{% if inventory_hostname == groups['valkey'][0] %} -{# Migration mode: valkey[0] replicates from Redis #} +{% if inventory_hostname == groups['valkey'][0] %} +{# Migration mode: valkey[0] replicates from Redis #} replicaof {{ 'api' | kolla_address(groups['redis'][0]) }} {{ redis_port }} masterauth {{ redis_master_password }} -{% elif not inventory_hostname == groups['valkey'][0] %} -{# Secondary valkey nodes replicate from valkey[0] #} +{% elif not inventory_hostname == groups['valkey'][0] %} +{# Secondary valkey nodes replicate from valkey[0] #} replicaof {{ 'api' | kolla_address(groups['valkey'][0]) }} {{ valkey_server_port }} masterauth {{ valkey_master_password }} -{% endif %} +{% endif %} {% else %} {# Normal mode: valkey[0] is master #} {# NOTE: Keep this part after removing the migration block above #} -{% if not inventory_hostname == groups['valkey'][0] %} -{# Secondary valkey nodes replicate from valkey[0] #} +{% if not inventory_hostname == groups['valkey'][0] %} +{# Secondary valkey nodes replicate from valkey[0] #} replicaof {{ 'api' | kolla_address(groups['valkey'][0]) }} {{ valkey_server_port }} -{% endif %} +{% endif %} requirepass {{ valkey_master_password }} masterauth {{ valkey_master_password }} {% endif %} diff --git a/lint-requirements.txt b/lint-requirements.txt index 83c34c89a..9149f3737 100644 --- a/lint-requirements.txt +++ b/lint-requirements.txt @@ -5,6 +5,7 @@ bashate>=0.5.1 # Apache-2.0 codespell<3 # GPLv2 doc8>=0.6.0 # Apache-2.0 hacking>=3.0.1 # Apache-2.0 +j2lint<2 # MIT pycodestyle>=2.11.0 # MIT reno>=3.1.0 # Apache-2.0 yamllint>=1.22.0 #GPL3 diff --git a/releasenotes/notes/lightbits-jwt-84fba12dd05108c0.yaml b/releasenotes/notes/lightbits-jwt-84fba12dd05108c0.yaml new file mode 100644 index 000000000..e9849d1f1 --- /dev/null +++ b/releasenotes/notes/lightbits-jwt-84fba12dd05108c0.yaml @@ -0,0 +1,4 @@ +--- +upgrade: + - | + ``lightbits_JWT`` variable has been renamed to ``lightbits_jwt`` diff --git a/tests/j2lint.py b/tests/j2lint.py deleted file mode 100755 index b3981af24..000000000 --- a/tests/j2lint.py +++ /dev/null @@ -1,88 +0,0 @@ -#!/usr/bin/env python3 - -# Copyright 2020 StackHPC Ltd. -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -""" -Original license: -@author Gerard van Helden <drm@melp.nl> -@license DBAD, see <http://www.dbad-license.org/> -@url https://github.com/drm/jinja2-lint -Simple j2 linter, useful for checking jinja2 template syntax - -Adapted for OpenStack Kolla/Kolla-Ansible purposes -""" - -from ansible.plugins.filter.core import get_encrypted_password -from ansible.plugins.filter.core import to_json -from functools import reduce -from jinja2 import BaseLoader -from jinja2 import Environment -from jinja2 import exceptions -from jinja2 import TemplateNotFound -from kolla_ansible import kolla_address -from kolla_ansible import put_address_in_context -import os.path -try: - from ansible_collections.ansible.utils.plugins.filter import ipwrap -except ImportError: - from ansible_collections.ansible.netcommon.plugins.filter import ipwrap - - -class AbsolutePathLoader(BaseLoader): - def get_source(self, environment, template): - if not os.path.exists(template): - raise TemplateNotFound(template) - mtime = os.path.getmtime(template) - with open(template) as file: - source = file.read() - return source, template, lambda: mtime == os.path.getmtime(template) - - -def check(template, out, err, env=Environment(loader=AbsolutePathLoader(), - autoescape=True)): - try: - env.filters['basename'] = os.path.basename - env.filters['bool'] = bool - env.filters['hash'] = hash - env.filters['to_json'] = to_json - # NOTE(wszumski): password_hash is mapped to the function: - # get_encrypted_password in ansible.filters.core. - env.filters['password_hash'] = get_encrypted_password - env.filters['kolla_address'] = kolla_address - env.filters['put_address_in_context'] = put_address_in_context - env.filters['ipwrap'] = ipwrap - env.get_template(template) - out.write("%s: Syntax OK\n" % template) - return 0 - except TemplateNotFound: - err.write("%s: File not found\n" % template) - return 2 - except exceptions.TemplateSyntaxError as ex: - err.write("%s: Syntax check failed: %s in %s at %d\n" - % (template, ex.message, ex.filename, ex.lineno)) - return 1 - - -def main(**kwargs): - import sys - try: - sys.exit(reduce(lambda r, fn: r + - check(fn, sys.stdout, sys.stderr, **kwargs), - sys.argv[1:], 0)) - except IndexError: - sys.stdout.write("Usage: j2lint.py filename [filename ...]\n") - - -if __name__ == "__main__": - main() diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2 index 2c524a791..01444d0b9 100644 --- a/tests/templates/globals-default.j2 +++ b/tests/templates/globals-default.j2 @@ -18,10 +18,10 @@ docker_yum_url: "http://{{ zuul_site_mirror_fqdn }}:8080/docker/centos" podman_debug: true podman_registry_mirrors: - {{ infra_dockerhub_mirror }} -{% if need_build_image and is_previous_release %} +{% if need_build_image and is_previous_release %} podman_registry: "primary:4000" podman_registry_insecure: true -{% endif %} +{% endif %} {% else %} docker_debug: true docker_apt_package_pin: "5:28.*" @@ -33,11 +33,11 @@ docker_registry_mirrors: # as docker_registry var is being used both for docker daemon config # - for kolla images build, and kolla-ansible container images sources. # docker_custom_config gets precedence in docker daemon configuration. -{% if need_build_image and is_previous_release %} +{% if need_build_image and is_previous_release %} docker_custom_config: insecure-registries: - primary:4000 -{% endif %} +{% endif %} {% endif %} # MariaDB/Galera - fine tune timeouts @@ -78,16 +78,16 @@ docker_namespace: "lokolla" # see: https://github.com/moby/moby/issues/39033 docker_registry: "primary:4000" docker_registry_insecure: yes -{% if container_engine == 'podman' %} +{% if container_engine == 'podman' %} podman_registry: "primary:4000" podman_registry_insecure: yes -{% endif %} +{% endif %} openstack_tag: "{{ build_image_tag }}" {% else %} docker_namespace: openstack.kolla -{% if docker_image_tag_suffix %} +{% if docker_image_tag_suffix %} openstack_tag_suffix: "{{ docker_image_tag_suffix }}" -{% endif %} +{% endif %} {% endif %} {% if scenario == "zun" %} @@ -163,17 +163,17 @@ rabbitmq_cluster_partition_handling: "autoheal" rabbitmq_extra_config: cluster_keepalive_interval: 50000 # TODO(bbezak): Remove in H/2026.2 cycle -{% if is_slurp and is_previous_release %} +{% if is_slurp and is_previous_release %} enable_redis: "yes" -{% endif %} +{% endif %} enable_ceph_rgw: "yes" ceph_rgw_hosts: -{% for host in hostvars | reject('equalto', 'localhost') %} +{% for host in hostvars | reject('equalto', 'localhost') %} - host: {{ host }} ip: {{ hostvars[host]['ansible_host'] }} port: 6780 -{% endfor %} +{% endfor %} {% endif %} {% if tls_enabled %} @@ -181,12 +181,12 @@ kolla_enable_tls_external: "yes" kolla_enable_tls_internal: "yes" kolla_copy_ca_into_containers: "yes" kolla_enable_tls_backend: "yes" -{% if base_distro in ["debian", "ubuntu"] %} +{% if base_distro in ["debian", "ubuntu"] %} openstack_cacert: "/etc/ssl/certs/ca-certificates.crt" -{% endif %} -{% if base_distro in ["centos", "rocky"] %} +{% endif %} +{% if base_distro in ["centos", "rocky"] %} openstack_cacert: "/etc/pki/tls/certs/ca-bundle.crt" -{% endif %} +{% endif %} kolla_admin_openrc_cacert: "{% raw %}{{ kolla_certificates_dir }}{% endraw %}/ca/root.crt" rabbitmq_enable_tls: "yes" libvirt_tls: "yes" diff --git a/tests/templates/inventory.j2 b/tests/templates/inventory.j2 index 8441d825e..b5bb76907 100644 --- a/tests/templates/inventory.j2 +++ b/tests/templates/inventory.j2 @@ -7,13 +7,13 @@ [control] {% if scenario == 'masakari' %} -{% for host in hostvars if host in ['primary'] %} +{% for host in hostvars if host in ['primary'] %} {{ host }} ansible_host={{ hostvars[host]['ansible_host'] }} -{% endfor %} +{% endfor %} {% else %} -{% for host in hostvars | reject('equalto', 'localhost') %} +{% for host in hostvars | reject('equalto', 'localhost') %} {{ host }} ansible_host={{ hostvars[host]['ansible_host'] }} -{% endfor %} +{% endfor %} {% endif %} [network:children] @@ -27,13 +27,13 @@ control [compute] {% if scenario == 'masakari' %} -{% for host in hostvars if host in ['ternary1', 'ternary2'] %} +{% for host in hostvars if host in ['ternary1', 'ternary2'] %} {{ host }} ansible_host={{ hostvars[host]['ansible_host'] }} -{% endfor %} +{% endfor %} {% else %} -{% for host in hostvars | reject('equalto', 'localhost') %} +{% for host in hostvars | reject('equalto', 'localhost') %} {{ host }} ansible_host={{ hostvars[host]['ansible_host'] }} -{% endfor %} +{% endfor %} {% endif %} [storage] @@ -52,8 +52,8 @@ control {% endfor %} {% if scenario == 'cells' %} -{% for host in hostvars | reject('equalto', 'localhost') %} -{% set cell_name = 'cell' ~ loop.index %} +{% for host in hostvars | reject('equalto', 'localhost') %} +{% set cell_name = 'cell' ~ loop.index %} [{{ cell_name }}] {{ host }} ansible_host={{ hostvars[host]['ansible_host'] }} mariadb_shard_id={{ loop.index0 % 2 }} @@ -65,7 +65,7 @@ nova_cell_novncproxy_group = {{ cell_name }} nova_novncproxy_port = {{ 6080 + loop.index0 }} nova_cell_database_shard_id = {{ loop.index0 % 2 }} -{% endfor %} +{% endfor %} {% endif %} [baremetal:children] @@ -124,9 +124,9 @@ storage [hacluster] {% for host in hostvars | reject('equalto', 'localhost') %} -{% if host in ['primary', 'secondary'] %} +{% if host in ['primary', 'secondary'] %} {{ host }} ansible_host={{ hostvars[host]['ansible_host'] }} -{% endif %} +{% endif %} {% endfor %} [hacluster-remote:children] diff --git a/tests/templates/nova-compute-overrides.j2 b/tests/templates/nova-compute-overrides.j2 index 7bcbaf11c..032155cca 100644 --- a/tests/templates/nova-compute-overrides.j2 +++ b/tests/templates/nova-compute-overrides.j2 @@ -9,8 +9,8 @@ cpu_model=max # newer than the qemu default of qemu64. Nehalem is apparently the # oldest model that works for x86_64-v2 and is expected to work on # Intel and AMD cpus with kvm or qemu. -{% if virt_type == 'kvm' %} +{% if virt_type == 'kvm' %} cpu_mode = custom cpu_models = Nehalem -{% endif %} +{% endif %} {% endif %} @@ -149,8 +149,7 @@ commands = bandit --skip B303 -r ansible kolla_ansible tests tools [testenv:j2lint] deps = {[testenv:linters]deps} -commands = - find {toxinidir} -type f -name "*.j2" -not -path "*/.tox/*" -exec {toxinidir}/tests/j2lint.py \{\} + +commands = j2lint ansible/ roles/ tests/ --ignore single-statement-per-line [testenv:ansible-lint] # Lint only code in ansible/* - ignore tests/ and roles/ used by CI |