aboutsummaryrefslogtreecommitdiff
path: root/ansible
diff options
context:
space:
mode:
Diffstat (limited to 'ansible')
-rw-r--r--ansible/group_vars/all/neutron.yml2
-rw-r--r--ansible/library/kolla_toolbox.py5
-rw-r--r--ansible/module_utils/kolla_podman_worker.py8
-rw-r--r--ansible/roles/barbican/defaults/main.yml2
-rw-r--r--ansible/roles/glance/tasks/config.yml5
-rw-r--r--ansible/roles/heat/templates/heat-api-cfn.json.j23
-rw-r--r--ansible/roles/heat/templates/heat-api.json.j23
-rw-r--r--ansible/roles/nova-cell/defaults/main.yml11
-rw-r--r--ansible/roles/nova-cell/tasks/config.yml60
-rw-r--r--ansible/roles/nova-cell/tasks/version-check.yml44
-rw-r--r--ansible/roles/nova-cell/templates/libvirtd.conf.j210
-rw-r--r--ansible/roles/nova-cell/templates/nova-compute.json.j26
-rw-r--r--ansible/roles/nova-cell/templates/nova-libvirt.json.j22
-rw-r--r--ansible/roles/nova-cell/templates/qemu.conf.j22
-rw-r--r--ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j23
15 files changed, 155 insertions, 11 deletions
diff --git a/ansible/group_vars/all/neutron.yml b/ansible/group_vars/all/neutron.yml
index a46615445..2c1cc3138 100644
--- a/ansible/group_vars/all/neutron.yml
+++ b/ansible/group_vars/all/neutron.yml
@@ -28,7 +28,7 @@ neutron_plugin_agent: "openvswitch"
# Valid options are [ internal, infoblox ]
neutron_ipam_driver: "internal"
-eutron_external_interface: "eth1"
+neutron_external_interface: "eth1"
#######################
# Neutron options
diff --git a/ansible/library/kolla_toolbox.py b/ansible/library/kolla_toolbox.py
index 2749f3b4b..faa67dbe9 100644
--- a/ansible/library/kolla_toolbox.py
+++ b/ansible/library/kolla_toolbox.py
@@ -382,7 +382,10 @@ class KollaToolboxWorker():
try:
self._push_private_data_dir(kolla_toolbox, pdd, user)
+ exec_user = user or 'ansible'
runner_env = {}
+ if exec_user == 'ansible':
+ runner_env['HOME'] = _PDD_BASEDIR
if self.module._diff:
runner_env['ANSIBLE_DIFF_MODE'] = '1'
@@ -391,7 +394,7 @@ class KollaToolboxWorker():
['/opt/ansible/bin/ansible-runner', 'run', pdd,
'--playbook', 'main.json',
'--rotate-artifacts', '1'],
- user=user,
+ user=exec_user,
environment=runner_env
)
# exit 2 = task failed/unreachable; handled via event below.
diff --git a/ansible/module_utils/kolla_podman_worker.py b/ansible/module_utils/kolla_podman_worker.py
index 66e5bba1b..0b9e25ef8 100644
--- a/ansible/module_utils/kolla_podman_worker.py
+++ b/ansible/module_utils/kolla_podman_worker.py
@@ -538,8 +538,12 @@ class PodmanWorker(ContainerWorker):
if rc == 0:
return False
elif rc == 1:
- self._config_diff = (raw_output.decode('utf-8') if
- isinstance(raw_output, bytes) else raw_output)
+ try:
+ self._config_diff = (raw_output.decode('utf-8') if
+ isinstance(raw_output, bytes) else
+ raw_output)
+ except UnicodeDecodeError:
+ self._config_diff = 'container changed during config check'
return True
else:
raise Exception('Failed to compare container configuration: '
diff --git a/ansible/roles/barbican/defaults/main.yml b/ansible/roles/barbican/defaults/main.yml
index 5e1ad0287..9d25bf6ea 100644
--- a/ansible/roles/barbican/defaults/main.yml
+++ b/ansible/roles/barbican/defaults/main.yml
@@ -109,7 +109,7 @@ barbican_api_healthcheck_test:
- >-
healthcheck_curl {{
'https' if barbican_enable_tls_backend | bool else 'http' }}://{{
- api_interface_address | put_address_in_context('url') }}:{{ barbican_api_listen_port }}/healthcheck"
+ api_interface_address | put_address_in_context('url') }}:{{ barbican_api_listen_port }}/healthcheck
barbican_api_healthcheck_timeout: "{{ default_container_healthcheck_timeout }}"
barbican_api_healthcheck:
interval: "{{ barbican_api_healthcheck_interval }}"
diff --git a/ansible/roles/glance/tasks/config.yml b/ansible/roles/glance/tasks/config.yml
index 7fa92b260..c7e91de5b 100644
--- a/ansible/roles/glance/tasks/config.yml
+++ b/ansible/roles/glance/tasks/config.yml
@@ -50,9 +50,14 @@
ansible.builtin.include_role:
name: service-uwsgi-config
vars:
+ _glance_uwsgi_cacert_env:
+ REQUESTS_CA_BUNDLE: "{{ openstack_cacert }}"
+ SSL_CERT_FILE: "{{ openstack_cacert }}"
project_services: "{{ glance_services }}"
service: "{{ glance_services['glance-api'] }}"
service_name: "glance-api"
+ service_uwsgi_config_chunked_input_limit: "{{ '64M' | human_to_bytes }}"
+ service_uwsgi_config_env: "{{ _glance_uwsgi_cacert_env if kolla_enable_tls_internal else {} }}"
service_uwsgi_config_http_port: "{{ glance_api_listen_port }}"
service_uwsgi_config_log_file_chmod: "644"
service_uwsgi_config_module: "{{ service.wsgi }}"
diff --git a/ansible/roles/heat/templates/heat-api-cfn.json.j2 b/ansible/roles/heat/templates/heat-api-cfn.json.j2
index a903217b0..640140ccb 100644
--- a/ansible/roles/heat/templates/heat-api-cfn.json.j2
+++ b/ansible/roles/heat/templates/heat-api-cfn.json.j2
@@ -30,8 +30,7 @@
"dest": "/etc/heat/certs/heat-key.pem",
"owner": "heat",
"perm": "0600"
- }
- {% endif %}{% if kolla_copy_ca_into_containers | bool %},
+ }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
{
"source": "{{ container_config_directory }}/ca-certificates",
"dest": "/var/lib/kolla/share/ca-certificates",
diff --git a/ansible/roles/heat/templates/heat-api.json.j2 b/ansible/roles/heat/templates/heat-api.json.j2
index 5edd0df49..07deb3909 100644
--- a/ansible/roles/heat/templates/heat-api.json.j2
+++ b/ansible/roles/heat/templates/heat-api.json.j2
@@ -30,8 +30,7 @@
"dest": "/etc/heat/certs/heat-key.pem",
"owner": "heat",
"perm": "0600"
- }
- {% endif %}{% if kolla_copy_ca_into_containers | bool %},
+ }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
{
"source": "{{ container_config_directory }}/ca-certificates",
"dest": "/var/lib/kolla/share/ca-certificates",
diff --git a/ansible/roles/nova-cell/defaults/main.yml b/ansible/roles/nova-cell/defaults/main.yml
index 790190fb0..918de4463 100644
--- a/ansible/roles/nova-cell/defaults/main.yml
+++ b/ansible/roles/nova-cell/defaults/main.yml
@@ -639,6 +639,17 @@ libvirt_sasl_authname: "nova"
libvirt_sasl_mech_list:
- "{{ 'SCRAM-SHA-256' if libvirt_tls | bool else 'DIGEST-MD5' }}"
+# Connection processing limits for libvirtd. nova-compute is effectively the
+# only privileged client of libvirtd under Kolla, so libvirt's stock per-client
+# request cap (max_client_requests=5) is the binding constraint rather than a
+# safety net: concurrent instance builds plus the resource-tracker periodic
+# routinely exceed five in-flight RPCs, which starves keepalive responses until
+# libvirtd drops the connection. Raise the per-client cap, and the worker pool
+# along with it so that lifting the per-client limit does not starve other
+# connections (live migration, health checks, periodics).
+libvirt_max_client_requests: 20
+libvirt_max_workers: 50
+
####################
# Kolla
####################
diff --git a/ansible/roles/nova-cell/tasks/config.yml b/ansible/roles/nova-cell/tasks/config.yml
index f9e9c10ee..83569eedd 100644
--- a/ansible/roles/nova-cell/tasks/config.yml
+++ b/ansible/roles/nova-cell/tasks/config.yml
@@ -54,6 +54,66 @@
when:
- vendordata_file.stat.exists
+- name: Ensure compute_id exists in nova_compute volume
+ vars:
+ service: "{{ nova_cell_services['nova-compute'] }}"
+ hypervisor_nodename: "{{ hostvars[inventory_hostname].ansible_facts.nodename }}"
+ when: service | service_enabled_and_mapped_to_host
+ block:
+ - name: List all hypervisors
+ kolla_toolbox:
+ container_engine: "{{ kolla_container_engine }}"
+ module_name: openstack.cloud.resources
+ module_args:
+ auth: "{{ openstack_auth }}"
+ cloud: "{{ openstack_auth_cloud }}"
+ ca_cert: "{{ openstack_cacert }}"
+ region_name: "{{ openstack_region_name }}"
+ endpoint_type: "{{ openstack_interface }}"
+ service: "compute"
+ type: "hypervisor"
+ register: hypervisors
+ check_mode: false
+ become: true
+ delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
+
+ - name: Match current hypervisor
+ ansible.builtin.set_fact:
+ matched_hypervisors: >-
+ {{ hypervisors.resources | selectattr('name', 'equalto', hypervisor_nodename) }}
+ when: hypervisors.resources | length > 0
+
+ - name: Assert that only one hypervisor was matched
+ ansible.builtin.assert:
+ that:
+ - matched_hypervisors | length == 1
+ fail_msg: |
+ "Found multiple compute services with same host name, please check your Nova "
+ "compute agents list and fix it. The query with hypervisor name "
+ "'{{ hypervisor_nodename }}' returned following: {{ matched_hypervisors }}"
+ when:
+ - hypervisors.resources | length > 0
+ - matched_hypervisors | length > 0
+
+ - name: Copy the matched hypervisor UUID to compute_id
+ ansible.builtin.copy:
+ content: "{{ matched_hypervisors[0].id }}"
+ dest: "{{ node_config_directory }}/nova-compute/compute_id"
+ mode: "0660"
+ become: true
+ when:
+ - hypervisors.resources | length > 0
+ - matched_hypervisors | length == 1
+
+ # If the host was never registered, create a new hypervisor id and copy as compute_id
+ - name: Generate a new UUID then copy to compute_id
+ ansible.builtin.copy:
+ content: "{{ hypervisor_nodename | to_uuid }}"
+ dest: "{{ node_config_directory }}/nova-compute/compute_id"
+ mode: "0660"
+ become: true
+ when: hypervisors.resources | length == 0 or matched_hypervisors | length == 0
+
- name: Copying over config.json files for services
become: true
ansible.builtin.template:
diff --git a/ansible/roles/nova-cell/tasks/version-check.yml b/ansible/roles/nova-cell/tasks/version-check.yml
index 549cb3334..d217f88ba 100644
--- a/ansible/roles/nova-cell/tasks/version-check.yml
+++ b/ansible/roles/nova-cell/tasks/version-check.yml
@@ -75,3 +75,47 @@
success_msg: >
Libvirt version check successful: target {{ new_version }} >= current {{ current_version }}.
when: libvirt_version_current_results is not skipped
+
+- name: Check nova_libvirt image provides the libvirt start script
+ when: enable_nova_libvirt_container | bool and (groups[service.group] | length) > 0
+ vars:
+ service_name: "nova-libvirt"
+ service: "{{ nova_cell_services[service_name] }}"
+ tags: nova-libvirt-script-check
+ block:
+ - name: Look for kolla_nova_libvirt_start in the nova_libvirt image
+ become: true
+ kolla_container:
+ action: "start_container"
+ command: "ls /usr/local/bin/kolla_nova_libvirt_start"
+ common_options: "{{ docker_common_options }}"
+ container_engine: "{{ kolla_container_engine }}"
+ detach: false
+ environment:
+ KOLLA_CONFIG_STRATEGY: "{{ config_strategy }}"
+ image: "{{ service.image }}"
+ name: "nova_libvirt_script_check"
+ restart_policy: oneshot
+ remove_on_exit: true
+ register: nova_libvirt_script_check
+ failed_when: false
+ check_mode: false
+ run_once: true
+ delegate_to: "{{ groups[service.group] | first }}"
+
+ - name: Assert the nova_libvirt image is recent enough
+ run_once: true
+ delegate_to: "{{ groups[service.group] | first }}"
+ ansible.builtin.assert:
+ that:
+ - "'/usr/local/bin/kolla_nova_libvirt_start' in (nova_libvirt_script_check.stdout | default(''))"
+ fail_msg: >
+ The nova_libvirt image '{{ service.image }}' does not contain
+ /usr/local/bin/kolla_nova_libvirt_start, which this version of
+ Kolla-Ansible needs to launch libvirtd alongside virtlogd. This
+ almost always means the container image has not been updated to
+ match the upgraded Kolla-Ansible code. Pull or build a current
+ nova-libvirt image before deploying. If you intend to keep using
+ an older image, skip the tag 'nova-libvirt-script-check'.
+ success_msg: >
+ nova_libvirt image provides kolla_nova_libvirt_start.
diff --git a/ansible/roles/nova-cell/templates/libvirtd.conf.j2 b/ansible/roles/nova-cell/templates/libvirtd.conf.j2
index aa01f743d..d156fb4be 100644
--- a/ansible/roles/nova-cell/templates/libvirtd.conf.j2
+++ b/ansible/roles/nova-cell/templates/libvirtd.conf.j2
@@ -25,3 +25,13 @@ listen_addr = "{{ migration_interface_address }}"
# Enable read-only access to libvirt socket
auth_unix_ro = "none"
{% endif %}
+
+# Connection processing limits. libvirt's defaults (max_workers=20,
+# max_client_requests=5) assume a multi-tenant host with many mutually
+# distrustful clients. Under Kolla, nova-compute is effectively the sole
+# privileged client, so the per-client cap of 5 becomes the binding
+# constraint: concurrent builds plus the resource-tracker periodic exceed
+# five in-flight RPCs and starve keepalive responses, causing libvirtd to
+# drop the connection after keepalive_interval (5s) x keepalive_count (5).
+max_workers = {{ libvirt_max_workers }}
+max_client_requests = {{ libvirt_max_client_requests }}
diff --git a/ansible/roles/nova-cell/templates/nova-compute.json.j2 b/ansible/roles/nova-cell/templates/nova-compute.json.j2
index 400301d21..b90367a42 100644
--- a/ansible/roles/nova-cell/templates/nova-compute.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-compute.json.j2
@@ -6,6 +6,12 @@
"dest": "/etc/nova/nova.conf",
"owner": "nova",
"perm": "0600"
+ },
+ {
+ "source": "{{ container_config_directory }}/compute_id",
+ "dest": "/var/lib/nova/compute_id",
+ "owner": "nova",
+ "perm": "0600"
}{% if nova_policy_file is defined %},
{
"source": "{{ container_config_directory }}/{{ nova_policy_file }}",
diff --git a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
index f64098707..5a6ece358 100644
--- a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
@@ -1,5 +1,5 @@
{
- "command": "/usr/sbin/libvirtd --listen",
+ "command": "/usr/local/bin/kolla_nova_libvirt_start",
"config_files": [
{
"source": "{{ container_config_directory }}/libvirtd.conf",
diff --git a/ansible/roles/nova-cell/templates/qemu.conf.j2 b/ansible/roles/nova-cell/templates/qemu.conf.j2
index 03b56479a..1a828ecb5 100644
--- a/ansible/roles/nova-cell/templates/qemu.conf.j2
+++ b/ansible/roles/nova-cell/templates/qemu.conf.j2
@@ -1,4 +1,4 @@
-stdio_handler = "file"
+stdio_handler = "logd"
user = "nova"
group = "nova"
diff --git a/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2 b/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2
index ef0a5d373..e8873eefc 100644
--- a/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2
+++ b/ansible/roles/service-uwsgi-config/templates/uwsgi.ini.j2
@@ -1,6 +1,9 @@
[uwsgi]
add-header = Connection: close
buffer-size = 65535
+{% if service_uwsgi_config_chunked_input_limit is defined %}
+chunked-input-limit = {{ service_uwsgi_config_chunked_input_limit }}
+{% endif %}
die-on-term = true
enable-threads = true
exit-on-reload = false
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 16:35:25 +0000