diff options
Diffstat (limited to 'doc')
25 files changed, 204 insertions, 66 deletions
diff --git a/doc/source/admin/advanced-configuration.rst b/doc/source/admin/advanced-configuration.rst index c0177341a..579dd11ca 100644 --- a/doc/source/admin/advanced-configuration.rst +++ b/doc/source/admin/advanced-configuration.rst @@ -271,10 +271,6 @@ By default, HAProxy uses ``local1``. syslog_haproxy_facility: "local1" -If Glance TLS backend is enabled (``glance_enable_tls_backend``), the syslog -facility for the ``glance_tls_proxy`` service uses ``local2`` by default. This -can be set via ``syslog_glance_tls_proxy_facility``. - Mount additional Docker volumes in containers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/doc/source/admin/mariadb-backup-and-restore.rst b/doc/source/admin/mariadb-backup-and-restore.rst index 6ebb73d5b..596b7f952 100644 --- a/doc/source/admin/mariadb-backup-and-restore.rst +++ b/doc/source/admin/mariadb-backup-and-restore.rst @@ -41,11 +41,11 @@ Backup Procedure To perform a full backup, run the following command: -``kolla-ansible mariadb_backup -i INVENTORY`` +``kolla-ansible mariadb-backup -i INVENTORY`` Or to perform an incremental backup: -``kolla-ansible mariadb_backup -i INVENTORY --incremental`` +``kolla-ansible mariadb-backup -i INVENTORY --incremental`` Kolla doesn't currently manage the scheduling of these backups, so you'll need to configure an appropriate scheduler (i.e cron) to run these commands @@ -83,7 +83,7 @@ following options on the first database node: docker run --rm -it --volumes-from mariadb --name dbrestore \ --volume mariadb_backup:/backup \ - quay.io/openstack.kolla/mariadb-server:|KOLLA_OPENSTACK_RELEASE|-rocky-9 \ + quay.io/openstack.kolla/mariadb-server:|KOLLA_OPENSTACK_RELEASE|-rocky-10 \ /bin/bash (dbrestore) $ cd /backup (dbrestore) $ rm -rf /backup/restore @@ -105,7 +105,7 @@ place, again on the first node: docker run --rm -it --volumes-from mariadb --name dbrestore \ --volume mariadb_backup:/backup \ - quay.io/openstack.kolla/mariadb-server:|KOLLA_OPENSTACK_RELEASE|-rocky-9 \ + quay.io/openstack.kolla/mariadb-server:|KOLLA_OPENSTACK_RELEASE|-rocky-10 \ /bin/bash (dbrestore) $ rm -rf /var/lib/mysql/* (dbrestore) $ rm -rf /var/lib/mysql/\.[^\.]* @@ -127,7 +127,7 @@ pointing to the first node of the cluster: .. code-block:: console - kolla-ansible mariadb_recovery -i multinode -e mariadb_recover_inventory_name=controller1 + kolla-ansible mariadb-recovery -i multinode -e mariadb_recover_inventory_name=controller1 The above procedure is valid also for a disaster recovery scenario. In such case, first copy MariaDB backup file from the external source into @@ -148,7 +148,7 @@ incremental backup, docker run --rm -it --volumes-from mariadb --name dbrestore \ --volume mariadb_backup:/backup --tmpfs /backup/restore \ - quay.io/openstack.kolla/mariadb-server:|KOLLA_OPENSTACK_RELEASE|-rocky-9 \ + quay.io/openstack.kolla/mariadb-server:|KOLLA_OPENSTACK_RELEASE|-rocky-10 \ /bin/bash (dbrestore) $ cd /backup (dbrestore) $ rm -rf /backup/restore diff --git a/doc/source/admin/password-rotation.rst b/doc/source/admin/password-rotation.rst index 506709975..fe5b5bdb0 100644 --- a/doc/source/admin/password-rotation.rst +++ b/doc/source/admin/password-rotation.rst @@ -58,7 +58,7 @@ applied this way. * ``osprofiler_secret`` * ``prometheus_alertmanager_password`` * ``qdrouterd_password`` -* ``redis_master_password`` +* ``valkey_master_password`` It is possible to change more secrets however some require manual steps. The manual steps vary depending on the secret. They are listed below in the order diff --git a/doc/source/conf.py b/doc/source/conf.py index add1790c4..af435eeb3 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -142,10 +142,10 @@ else: TESTED_RUNTIMES_GOVERNANCE_URL =\ 'https://governance.openstack.org/tc/reference/runtimes/{}.html'.format(KOLLA_OPENSTACK_RELEASE) -ANSIBLE_CORE_VERSION_MIN = '2.17' -ANSIBLE_CORE_VERSION_MAX = '2.18' -ANSIBLE_VERSION_MIN = '10' -ANSIBLE_VERSION_MAX = '11' +ANSIBLE_CORE_VERSION_MIN = '2.19' +ANSIBLE_CORE_VERSION_MAX = '2.20' +ANSIBLE_VERSION_MIN = '12' +ANSIBLE_VERSION_MAX = '13' GLOBAL_VARIABLE_MAP = { '|ANSIBLE_CORE_VERSION_MIN|': ANSIBLE_CORE_VERSION_MIN, diff --git a/doc/source/contributor/adding-a-new-service.rst b/doc/source/contributor/adding-a-new-service.rst index 665439112..967ca139b 100644 --- a/doc/source/contributor/adding-a-new-service.rst +++ b/doc/source/contributor/adding-a-new-service.rst @@ -42,10 +42,10 @@ which Kolla uses throughout and which should be followed. * Log rotation - For OpenStack services there should be a ``cron-logrotate-PROJECT.conf.j2`` - template file in ``ansible/roles/common/templates`` with the following + template file in ``ansible/roles/cron/templates`` with the following content: - .. path ansible/roles/common/templates/cron-logrotate-PROJECT.conf.j2 + .. path ansible/roles/cron/templates/cron-logrotate-PROJECT.conf.j2 .. code-block:: console "/var/log/kolla/PROJECT/*.log" @@ -53,14 +53,14 @@ which Kolla uses throughout and which should be followed. } - For OpenStack services there should be an entry in the ``services`` list - in the ``cron.json.j2`` template file in ``ansible/roles/common/templates``. + in the ``cron.json.j2`` template file in ``ansible/roles/cron/templates``. * Log delivery - For OpenStack services the service should add a new ``rewriterule`` in the ``match`` element in the ``01-rewrite.conf.j2`` template file in - ``ansible/roles/common/templates/conf/filter`` to deliver log messages to - Elasticsearch. + ``ansible/roles/fluentd/templates/conf/filter`` to deliver log messages to + Opensearch. * Documentation diff --git a/doc/source/contributor/ci-matrix.csv b/doc/source/contributor/ci-matrix.csv new file mode 100644 index 000000000..c49b72868 --- /dev/null +++ b/doc/source/contributor/ci-matrix.csv @@ -0,0 +1,24 @@ +Scenario;Disabled;Voting;Tempest;Core;Upgrade;SLURP;Multinode;TLS;Ceph;Cinder;Octavia;Valkey;Notes
+AIO core;–;✅;✅;✅;✅;✅;–;✅;–;–;–;–;"Core OpenStack (Keystone/Glance/Neutron/Nova/Heat) with Horizon; RabbitMQ/MariaDB/Memcached; Fluentd."
+Bifrost;–;–;–;–;–;–;–;–;–;–;–;–;Bifrost baremetal provisioning standalone.
+Cells;–;✅;✅;–;✅;–;✅;–;–;–;–;–;"Nova Cells v2 + ProxySQL; Horizon/Heat on; dashboard sanity."
+Cephadm;–;✅;✅;✅;✅;✅;✅;✅;✅;–;✅;✅;"External Ceph (cinder/glance/nova) + RGW; RabbitMQ tuned."
+Container engine migration;❌;–;✅;✅;–;–;✅;✅;–;–;–;–;"Container engine migration playbook; Tempest smoke; currently disabled (failing)."
+Federation;–;–;✅;–;✅;–;✅;✅;–;–;–;–;Keystone federation behind httpd.
+HAProxy FQDN;–;–;✅;–;–;–;✅;✅;–;–;–;–;HAProxy VIP/FQDN handling.
+Ironic;–;–;✅;✅;–;–;–;–;–;–;–;–;"Ironic + Tenks; Prometheus on; DNSMasq/iSCSI helpers."
+IPv6;❌;–;✅;–;✅;–;–;–;–;–;–;–;"IPv6-only deployment; currently disabled (disk pressure)."
+Kayobe;–;–;–;–;–;–;–;–;–;–;–;–;Kayobe overcloud smoke (non-voting).
+KVM;–;–;–;✅;–;–;✅;–;–;–;–;–;Nested virt compute (KVM).
+Let's Encrypt;–;✅;✅;–;✅;–;✅;–;–;–;–;–;"Pebble ACME end-to-end, dashboard; DB/Rabbit TLS."
+Magnum;–;–;✅;–;–;–;–;–;–;–;–;–;Magnum + Designate + Trove.
+MariaDB;–;✅;–;✅;✅;–;✅;–;–;–;–;–;Galera + ProxySQL, Fluentd, HAProxy, Keepalived.
+Masakari;–;–;✅;–;–;–;–;–;–;–;–;✅;Masakari + Pacemaker.
+NFV;–;–;✅;–;✅;–;–;–;–;–;✅;✅;Tacker + Neutron SFC, Barbican, Mistral, Aodh.
+Octavia;–;–;✅;–;–;–;–;–;✅;✅;–;–;Octavia/Amphora.
+OpenBao;–;–;–;–;–;–;–;–;–;–;–;–;"OpenBao-backed password management (password round-trip only; no deploy)."
+OVN;–;✅;✅;✅;✅;–;✅;✅;–;✅;–;–;Neutron ML2/OVN + OVN Octavia provider.
+Prometheus + OpenSearch;–;–;–;✅;–;✅;✅;–;–;–;–;–;Fluentd, OpenSearch, Grafana, Prometheus, RabbitMQ/DB core.
+Skyline;❌;–;✅;–;–;✅;–;–;–;–;–;–;"Skyline dashboard; currently disabled (SSO issues)."
+Telemetry;–;–;✅;–;–;✅;–;–;–;–;✅;✅;Aodh, Ceilometer, Gnocchi.
+Zun;–;✅;✅;–;✅;✅;✅;✅;–;–;–;–;"Zun + Kuryr + Cinder LVM; etcd; dashboard."
diff --git a/doc/source/contributor/ci.rst b/doc/source/contributor/ci.rst index 71f9e3032..0ffd7d498 100644 --- a/doc/source/contributor/ci.rst +++ b/doc/source/contributor/ci.rst @@ -28,3 +28,21 @@ consumes a large amount of logging resources. Please note that git usually strips lines beginning with `#` from the commit message. This can be avoided by preceding the string with a space. + +CI coverage matrix +~~~~~~~~~~~~~~~~~~ + +Zuul job templates live in ``zuul.d`` and are applied in +``zuul.d/project.yaml``. Pipelines always run tox/python style+unit checks, +docs/release builds, and requirements checks; the matrix below shows the +scenario jobs in ``check``/``gate``. + +.. csv-table:: Scenario matrix + :header-rows: 1 + :file: ci-matrix.csv + :widths: 12 7 7 7 7 7 7 7 7 7 7 7 7 12 + :delim: ; + +Legend: ✅ = covered, ❌ = disabled, – = not covered. ``Core`` means the standard +Keystone/Glance/Neutron/Nova/Heat stack is deployed; ``Tempest`` indicates +smoke tests run; ``SLURP`` = Skip Level Upgrade Release Process. diff --git a/doc/source/contributor/contributing.rst b/doc/source/contributor/contributing.rst index 36e798561..7e9bff16a 100644 --- a/doc/source/contributor/contributing.rst +++ b/doc/source/contributor/contributing.rst @@ -56,9 +56,13 @@ directly, you can find the lists in Gerrit: New Feature Planning ~~~~~~~~~~~~~~~~~~~~ -New features are discussed via IRC or mailing list (with [kolla] prefix). -Kolla project keeps blueprints in `Launchpad <https://blueprints.launchpad.net/kolla-ansible>`__. -Specs are welcome but not strictly required. +New features are discussed via IRC or on the openstack-discuss mailing list +(please include the [kolla] prefix to your subject line). + +Kolla has previously used Launchpad blueprints, but now simply uses tracking +bugs for new feature work. Please tag any such bugs with a "[RFE]" prefix, +which indicates the bug is a Request For Enhancement. Bugs are discussed in +more detail in the next section. Task Tracking ~~~~~~~~~~~~~ diff --git a/doc/source/contributor/release-notes.rst b/doc/source/contributor/release-notes.rst index 5c783b9b8..766c64a39 100644 --- a/doc/source/contributor/release-notes.rst +++ b/doc/source/contributor/release-notes.rst @@ -22,9 +22,12 @@ Kolla Ansible (just like Kolla) uses the following release notes sections: * ``prelude`` --- filled in by the PTL before each release or RC. Other release note types may be applied per common sense. -Each change should include a release note unless being a ``TrivialFix`` -change or affecting only docs or CI. Such changes should `not` include -a release note to avoid confusion. + +When a release note is required: + +- ``feature`` - best included with docs change (if separate from the code) +- ``user impacting`` - to improve visibility of the change for users + Remember release notes are mostly for end users which, in case of Kolla, are OpenStack administrators/operators. In case of doubt, the core team will let you know what is required. diff --git a/doc/source/reference/bare-metal/ironic-guide.rst b/doc/source/reference/bare-metal/ironic-guide.rst index 62fc93673..fbbe00ff2 100644 --- a/doc/source/reference/bare-metal/ironic-guide.rst +++ b/doc/source/reference/bare-metal/ironic-guide.rst @@ -26,7 +26,7 @@ define a network to be used for the Ironic cleaning network: ironic_dnsmasq_interface: "eth1" ironic_cleaning_network: "public1" -Finally, define at least one DHCP range for Ironic inspector: +Finally, define at least one DHCP range for Ironic inspection: .. code-block:: yaml @@ -52,6 +52,16 @@ For example it can be the same address as default router for the range: routers: "192.168.5.1" ntp_server: "192.168.5.1" +Provide a DNS server if the inspection ramdisk (IPA) needs to resolve +Fully Qualified Domain Names (FQDNs) for API access. To specify multiple +servers, use a comma-separated list. + +.. code-block:: yaml + + ironic_dnsmasq_dhcp_ranges: + - range: "192.168.5.100,192.168.5.110" + dns_servers: "192.168.5.10,192.168.5.11" + To support DHCP relay, it is also possible to define a netmask in the range. It is advisable to also provide a router to allow the traffic to reach the Ironic server. @@ -76,7 +86,7 @@ The default lease time for each range can be configured globally via ``ironic_dnsmasq_dhcp_default_lease_time`` variable or per range via ``lease_time`` parameter. -In the same file, specify the PXE bootloader file for Ironic Inspector. The +In the same file, specify the PXE bootloader file for Ironic inspection. The file is relative to the ``/var/lib/ironic/tftpboot`` directory. The default is ``pxelinux.0``, and should be correct for x86 systems. Other platforms may require a different value, for example aarch64 on Debian requires @@ -86,7 +96,7 @@ require a different value, for example aarch64 on Debian requires ironic_dnsmasq_boot_file: pxelinux.0 -Ironic inspector also requires a deploy kernel and ramdisk to be placed in +Ironic inspection also requires a deploy kernel and ramdisk to be placed in ``/etc/kolla/config/ironic/``. The following example uses coreos which is commonly used in Ironic deployments, though any compatible kernel/ramdisk may be used: @@ -103,10 +113,30 @@ You may optionally pass extra kernel parameters to the inspection kernel using: .. code-block:: yaml - ironic_inspector_kernel_cmdline_extras: ['ipa-lldp-timeout=90.0', 'ipa-collect-lldp=1'] + ironic_kernel_cmdline_extras: ['ipa-lldp-timeout=90.0', 'ipa-collect-lldp=1'] in ``/etc/kolla/globals.yml``. +PXE filter (optional) +~~~~~~~~~~~~~~~~~~~~~ + +To keep parity with the standalone inspector you can enable the experimental +PXE filter service: + +.. code-block:: yaml + + enable_ironic_pxe_filter: "yes" + +The PXE filter container runs alongside ``ironic-dnsmasq`` and cleans up stale +DHCP entries. It is especially useful when auto discovery is enabled and when +the dnsmasq DHCP range overlaps with a Neutron-served network. For the upstream +details see +https://docs.openstack.org/ironic/latest/admin/inspection/pxe_filter.html. + +.. note:: + + Upstream still classifies this PXE filter implementation as experimental. + Configure conductor's HTTP server port (optional) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The port used for conductor's HTTP server is controlled via @@ -120,7 +150,7 @@ Revert to plain PXE (not recommended) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Starting with Yoga, Ironic has changed the default PXE from plain PXE to iPXE. Kolla Ansible follows this upstream decision by choosing iPXE as the default -for Ironic Inspector but allows users to revert to the previous default of +for Ironic inspection but allows users to revert to the previous default of plain PXE by setting the following in ``/etc/kolla/globals.yml``: @@ -215,7 +245,7 @@ Post-deployment configuration The :ironic-doc:`Ironic documentation <install/configure-glance-images>` describes how to create the deploy kernel and ramdisk and register them with Glance. In this example we're reusing the same images that were fetched for the -Inspector: +inspection: .. code-block:: console diff --git a/doc/source/reference/compute/nova-guide.rst b/doc/source/reference/compute/nova-guide.rst index 3cf5848d4..8e083f241 100644 --- a/doc/source/reference/compute/nova-guide.rst +++ b/doc/source/reference/compute/nova-guide.rst @@ -121,3 +121,13 @@ effectively remove the configuration when the Nova Compute service is restarted. If you choose to undefine `nova_cell_compute_provider_config` on a host, you must manually remove the generated config from inside the container, or recreate the container. + +Emulated virtual Trusted Platform Module (vTPM) +=============================================== + +Nova supports adding an emulated virtual Trusted Platform Module (vTPM) to +instances. This feature is implemented with the SWTPM (Software TPM Emulator) +package. To enable this feature, set ``enable_nova_swtpm`` to ``true``. +Beware of `limitations`__ that come with this solution. + + __ https://docs.openstack.org/nova/latest/admin/emulated-tpm.html#limitations diff --git a/doc/source/reference/containers/kuryr-guide.rst b/doc/source/reference/containers/kuryr-guide.rst index fbcbfd419..f748d16c5 100644 --- a/doc/source/reference/containers/kuryr-guide.rst +++ b/doc/source/reference/containers/kuryr-guide.rst @@ -26,7 +26,8 @@ The IP address is host running the etcd service. ```2375``` is port that allows Docker daemon to be accessed remotely. ```2379``` is the etcd listening port. -By default etcd and kuryr are disabled in the ``group_vars/all.yml``. +By default etcd and kuryr are disabled in the ``group_vars/all/etcd.yml`` and +``group_vars/all/kuryr.yml`` files. In order to enable them, you need to edit the file globals.yml and set the following variables diff --git a/doc/source/reference/databases/mariadb-guide.rst b/doc/source/reference/databases/mariadb-guide.rst index 71b51f77c..c4a40740e 100644 --- a/doc/source/reference/databases/mariadb-guide.rst +++ b/doc/source/reference/databases/mariadb-guide.rst @@ -22,7 +22,7 @@ an independent Galera cluster. This section explains how to configure multiple database shards. Currently, only one shard is accessible via the HAProxy load balancer and supported -by the ``kolla-ansible mariadb_backup`` command. This will be improved +by the ``kolla-ansible mariadb-backup`` command. This will be improved in future by using ProxySQL, allowing load balanced access to all shards. Deployment @@ -52,9 +52,9 @@ inventory file in the way described below: .. note:: If ``mariadb_shard_id`` is not defined for host in inventory file it will be set automatically - to ``mariadb_default_database_shard_id`` (default 0) from ``group_vars/all.yml`` and can be - overwritten in ``/etc/kolla/globals.yml``. Shard which is marked as default is special in case - of backup or loadbalance, as it is described below. + to ``mariadb_default_database_shard_id`` (default 0) from ``group_vars/all/mariadb.yml`` and + can be overwritten in ``/etc/kolla/globals.yml``. Shard which is marked as default is + special in case of backup or loadbalance, as it is described below. Loadbalancer ------------ diff --git a/doc/source/reference/message-queues/rabbitmq.rst b/doc/source/reference/message-queues/rabbitmq.rst index 0cb465e0d..375d58fe4 100644 --- a/doc/source/reference/message-queues/rabbitmq.rst +++ b/doc/source/reference/message-queues/rabbitmq.rst @@ -23,7 +23,6 @@ Encryption of the following channels is not currently supported: * RabbitMQ cluster traffic between RabbitMQ server nodes * RabbitMQ CLI communication with RabbitMQ server nodes -* RabbitMQ Management API and UI (backend connection from HAProxy to RabbitMQ) Client-server ------------- diff --git a/doc/source/reference/networking/designate-guide.rst b/doc/source/reference/networking/designate-guide.rst index 9a629ebb4..aa0932b87 100644 --- a/doc/source/reference/networking/designate-guide.rst +++ b/doc/source/reference/networking/designate-guide.rst @@ -51,10 +51,10 @@ Configure Designate options in ``/etc/kolla/globals.yml`` .. important:: If multiple nodes are assigned to be Designate workers, then you must - enable a supported coordination backend, currently only ``redis`` + enable a supported coordination backend, currently only ``valkey`` is supported. The backend choice can be overridden via the - ``designate_coordination_backend`` variable. It defaults to ``redis`` - when ``redis`` is enabled (``enable_redis`` is set to ``yes``). + ``designate_coordination_backend`` variable. It defaults to ``valkey`` + when ``valkey`` is enabled (``enable_valkey`` is set to ``yes``). The following additional variables are required depending on which backend you intend to use: diff --git a/doc/source/reference/networking/neutron.rst b/doc/source/reference/networking/neutron.rst index 0dae7dcb6..3994ed886 100644 --- a/doc/source/reference/networking/neutron.rst +++ b/doc/source/reference/networking/neutron.rst @@ -279,6 +279,13 @@ In order to deploy Neutron OVN Agent you need to set the following: Currently the agent is only needed for QoS for hardware offloaded ports. +When in need of running `ovn-nbctl` or `ovn-sbctl` commands it's most +convenient to run them from ``ovn_northd`` container: + +.. code-block:: console + + docker exec ovn_northd ovn-nbctl show + Mellanox Infiniband (ml2/mlnx) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -339,9 +346,10 @@ In this example: Running Neutron agents subprocesses in separate containers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -There is an experimental feature in Kolla-Ansible that allows to overcome -the issue of breaking data plane connectivity and dhcp services when -restarting neutron-l3-agent and neutron-dhcp-agent. +There is a feature in Kolla-Ansible that allows to overcome +the issue of breaking data plane connectivity, dhcp and metadata services +when restarting neutron-l3-agent and neutron-dhcp-agent in ml2/ovs or +restarting the neutron-ovn-metadata-agent in ml2/ovn. To enable it, modify the configuration in ``/etc/kolla/globals.yml``: diff --git a/doc/source/reference/networking/octavia.rst b/doc/source/reference/networking/octavia.rst index af08cf9e0..7a29d67fa 100644 --- a/doc/source/reference/networking/octavia.rst +++ b/doc/source/reference/networking/octavia.rst @@ -340,7 +340,7 @@ Now deploy Octavia: Amphora image ------------- -It is necessary to build an Amphora image. On CentOS / Rocky 9: +It is necessary to build an Amphora image. On CentOS / Rocky 10: .. code-block:: console diff --git a/doc/source/reference/orchestration-and-nfv/tacker-guide.rst b/doc/source/reference/orchestration-and-nfv/tacker-guide.rst index 78fdf4821..4c99e72e1 100644 --- a/doc/source/reference/orchestration-and-nfv/tacker-guide.rst +++ b/doc/source/reference/orchestration-and-nfv/tacker-guide.rst @@ -30,7 +30,7 @@ Preparation and Deployment ~~~~~~~~~~~~~~~~~~~~~~~~~~ By default tacker and required services are disabled in -the ``group_vars/all.yml`` file. +the ``group_vars/all/tacker.yml`` file. In order to enable them, you need to edit the file ``/etc/kolla/globals.yml`` and set the following variables: diff --git a/doc/source/reference/shared-services/keystone-guide.rst b/doc/source/reference/shared-services/keystone-guide.rst index d0958a3f9..b92230dcb 100644 --- a/doc/source/reference/shared-services/keystone-guide.rst +++ b/doc/source/reference/shared-services/keystone-guide.rst @@ -104,6 +104,20 @@ Example for Keycloak shown below: keystone_federation_oidc_additional_options: OIDCTokenBindingPolicy: disabled +When using OIDC, operators can also use the following variable +to customize the delay to retry authenticating in the IdP if the +authentication has timeout: + +``keystone_federation_oidc_error_page_retry_login_delay_milliseconds`` + Default is 5000 milliseconds (5 seconds). + +It is also possible to override the ``OIDCHTMLErrorTemplate``, +the custom error template page via: + +.. code-block:: yaml + + {{ node_custom_config }}/keystone/federation/modoidc-error-page.html + Identity providers configurations ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/doc/source/user/multinode.rst b/doc/source/user/multinode.rst index 21bf67fa4..5a0db7cf2 100644 --- a/doc/source/user/multinode.rst +++ b/doc/source/user/multinode.rst @@ -136,7 +136,7 @@ host or group variables: <https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#ansible-variable-precedence>`__ are quite complex, but it is worth becoming familiar with them if using host and group variables. The playbook group variables in -``ansible/group_vars/all.yml`` define global defaults, and these take +``ansible/group_vars/all/`` define global defaults, and these take precedence over variables defined in an inventory file and inventory ``group_vars/all``, but not over inventory ``group_vars/*``. Variables in 'extra' files (``globals.yml``) have the highest precedence, so any variables diff --git a/doc/source/user/operating-kolla.rst b/doc/source/user/operating-kolla.rst index 0b2d78eca..8e931997d 100644 --- a/doc/source/user/operating-kolla.rst +++ b/doc/source/user/operating-kolla.rst @@ -198,22 +198,49 @@ After this command is complete, the containers will have been recreated from the new images and all database schema upgrades and similar actions performed for you. + +CLI Command Completion +~~~~~~~~~~~~~~~~~~~~~~ + +Kolla Ansible supports shell command completion to make the CLI easier to use. + +To enable Bash completion, generate the completion script: + +.. code-block:: console + + kolla-ansible complete --shell bash > ~/.kolla_ansible_completion.sh + +Then, add the following line to your ``~/.bashrc`` file: + +.. code-block:: console + + source ~/.kolla_ansible_completion.sh + +Finally, reload your shell configuration: + +.. code-block:: console + + source ~/.bashrc + +.. note:: + + If you're using a shell other than Bash, replace ``--shell bash`` with your shell type, + e.g., ``zsh``, and adapt your shell's configuration file accordingly. + + Tips and Tricks ~~~~~~~~~~~~~~~ Kolla Ansible CLI ----------------- -When running the ``kolla-ansible`` CLI, additional arguments may be passed to -``ansible-playbook`` via the ``EXTRA_OPTS`` environment variable. - ``kolla-ansible deploy -i INVENTORY`` is used to deploy and start all Kolla containers. ``kolla-ansible destroy -i INVENTORY`` is used to clean up containers and volumes in the cluster. -``kolla-ansible mariadb_recovery -i INVENTORY`` is used to recover a +``kolla-ansible mariadb-recovery -i INVENTORY`` is used to recover a completely stopped mariadb cluster. ``kolla-ansible prechecks -i INVENTORY`` is used to check if all requirements @@ -242,6 +269,10 @@ images on hosts. files for enabled OpenStack services, without then restarting the containers so it is not applied right away. +``kolla-ansible validate-config -i INVENTORY`` is used to validate generated +configuration files of enabled OpenStack services. By default, the results are +saved to ``/var/log/kolla/config-validate`` when issues are detected. + ``kolla-ansible ... -i INVENTORY1 -i INVENTORY2`` Multiple inventories can be specified by passing the ``--inventory`` or ``-i`` command line option multiple times. This can be useful to share configuration between multiple environments. diff --git a/doc/source/user/quickstart-development.rst b/doc/source/user/quickstart-development.rst index 0dccdb1f1..6e29a2ad5 100644 --- a/doc/source/user/quickstart-development.rst +++ b/doc/source/user/quickstart-development.rst @@ -186,7 +186,7 @@ There are a few options that are required to deploy Kolla Ansible: - Rocky (``rocky``) - Ubuntu (``ubuntu``) - For newcomers, we recommend to use Rocky Linux 9 or Ubuntu 24.04. + For newcomers, we recommend to use Rocky Linux 10 or Ubuntu 24.04. .. code-block:: console diff --git a/doc/source/user/quickstart.rst b/doc/source/user/quickstart.rst index 4afcab38a..b4d855367 100644 --- a/doc/source/user/quickstart.rst +++ b/doc/source/user/quickstart.rst @@ -177,7 +177,7 @@ There are a few options that are required to deploy Kolla Ansible: - Rocky (``rocky``) - Ubuntu (``ubuntu``) - For newcomers, we recommend to use Rocky Linux 9 or Ubuntu 24.04. + For newcomers, we recommend to use Rocky Linux 10 or Ubuntu 24.04. .. code-block:: console diff --git a/doc/source/user/support-matrix.rst b/doc/source/user/support-matrix.rst index 0301775f1..b2ce35427 100644 --- a/doc/source/user/support-matrix.rst +++ b/doc/source/user/support-matrix.rst @@ -9,13 +9,13 @@ Kolla Ansible supports the following host Operating Systems (OS): .. note:: - CentOS Stream 9 is supported as a host OS while Kolla does not publish CS9 + CentOS Stream 10 is supported as a host OS while Kolla does not publish CS10 based images. Users can build them on their own. We recommend using Rocky - Linux 9 images instead. + Linux 10 images instead. -* CentOS Stream 9 -* Debian Bookworm (12) -* Rocky Linux 9 +* CentOS Stream 10 +* Debian Trixie (13) +* Rocky Linux 10 * Ubuntu Noble (24.04) Supported container images diff --git a/doc/source/user/troubleshooting.rst b/doc/source/user/troubleshooting.rst index d00a94ca7..76a9ac604 100644 --- a/doc/source/user/troubleshooting.rst +++ b/doc/source/user/troubleshooting.rst @@ -88,13 +88,13 @@ You can find all kolla logs in there. /var/lib/docker/volumes/kolla_logs/_data When ``enable_central_logging`` is enabled, to view the logs in a web browser -using Kibana, go to -``http://<kolla_internal_vip_address>:<kibana_server_port>`` or -``http://<kolla_external_vip_address>:<kibana_server_port>``. Authenticate -using ``<kibana_user>`` and ``<kibana_password>``. +using OpenSearch Dashboards, go to +``http://<kolla_internal_vip_address>:<opensearch_dashboards_port>`` or +``http://<kolla_external_vip_address>:<opensearch_dashboards_port>``. Authenticate +using ``opensearch`` and ``<opensearch_dashboards_password>``. The values ``<kolla_internal_vip_address>``, ``<kolla_external_vip_address>`` -``<kibana_server_port>`` and ``<kibana_user>`` can be found in -``<kolla_install_path>/kolla/ansible/group_vars/all.yml`` or if the default -values are overridden, in ``/etc/kolla/globals.yml``. The value of -``<kibana_password>`` can be found in ``/etc/kolla/passwords.yml``. +``<opensearch_dashboards_port>`` can be found in +``<kolla_install_path>/kolla/ansible/group_vars/all/opensearch.yml``. The value +of ``<opensearch_dashboards_password>`` can be found in +``/etc/kolla/passwords.yml``. |