diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/requirements.txt | 9 | ||||
| -rw-r--r-- | doc/source/admin/mariadb-backup-and-restore.rst | 4 | ||||
| -rw-r--r-- | doc/source/admin/password-rotation.rst | 2 | ||||
| -rw-r--r-- | doc/source/admin/production-architecture-guide.rst | 10 | ||||
| -rw-r--r-- | doc/source/reference/bare-metal/ironic-guide.rst | 16 | ||||
| -rw-r--r-- | doc/source/reference/databases/mariadb-guide.rst | 2 | ||||
| -rw-r--r-- | doc/source/reference/logging-and-monitoring/grafana-guide.rst | 51 | ||||
| -rw-r--r-- | doc/source/reference/logging-and-monitoring/index.rst | 1 | ||||
| -rw-r--r-- | doc/source/reference/logging-and-monitoring/influxdb-guide.rst | 28 | ||||
| -rw-r--r-- | doc/source/reference/logging-and-monitoring/prometheus-guide.rst | 2 | ||||
| -rw-r--r-- | doc/source/reference/networking/neutron.rst | 9 | ||||
| -rw-r--r-- | doc/source/reference/rating/cloudkitty-guide.rst | 2 | ||||
| -rw-r--r-- | doc/source/user/quickstart.rst | 2 |
13 files changed, 93 insertions, 45 deletions
diff --git a/doc/requirements.txt b/doc/requirements.txt index da3f3abff..cd53b9f22 100644 --- a/doc/requirements.txt +++ b/doc/requirements.txt @@ -1,12 +1,5 @@ -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. -# Order matters to the pip dependency resolver, so sorting this file -# changes how packages are installed. New dependencies should be -# added in alphabetical order, however, some dependencies may need to -# be installed in a specific order. openstackdocstheme>=2.2.1 # Apache-2.0 reno>=3.1.0 # Apache-2.0 sphinx>=2.0.0,!=2.1.0 # BSD sphinxcontrib-svg2pdfconverter>=0.1.0 # BSD -whereto>=0.3.0 # Apache-2.0 +whereto>=0.5.0 # Apache-2.0 diff --git a/doc/source/admin/mariadb-backup-and-restore.rst b/doc/source/admin/mariadb-backup-and-restore.rst index aef6394a5..596b7f952 100644 --- a/doc/source/admin/mariadb-backup-and-restore.rst +++ b/doc/source/admin/mariadb-backup-and-restore.rst @@ -41,11 +41,11 @@ Backup Procedure To perform a full backup, run the following command: -``kolla-ansible mariadb_backup -i INVENTORY`` +``kolla-ansible mariadb-backup -i INVENTORY`` Or to perform an incremental backup: -``kolla-ansible mariadb_backup -i INVENTORY --incremental`` +``kolla-ansible mariadb-backup -i INVENTORY --incremental`` Kolla doesn't currently manage the scheduling of these backups, so you'll need to configure an appropriate scheduler (i.e cron) to run these commands diff --git a/doc/source/admin/password-rotation.rst b/doc/source/admin/password-rotation.rst index fe5b5bdb0..e5cfd0261 100644 --- a/doc/source/admin/password-rotation.rst +++ b/doc/source/admin/password-rotation.rst @@ -142,7 +142,7 @@ manually. .. code:: bash - mysql --batch -uroot -p + mariadb --batch -uroot -p #. Check the current state of the ``root`` user: diff --git a/doc/source/admin/production-architecture-guide.rst b/doc/source/admin/production-architecture-guide.rst index d1da7eaad..ced3571fa 100644 --- a/doc/source/admin/production-architecture-guide.rst +++ b/doc/source/admin/production-architecture-guide.rst @@ -14,6 +14,8 @@ Node types and services running on them A basic Kolla inventory consists of several types of nodes, known in Ansible as ``groups``. +* Deployment - Host from which you're running kolla-ansible CLI + * Control - Cloud controller nodes which host control services like APIs and databases. This group should have odd number of nodes for quorum. @@ -29,6 +31,14 @@ A basic Kolla inventory consists of several types of nodes, known in Ansible as * Monitoring - Monitor nodes which host monitoring services. +.. warning:: + + All hosts should be hardened and access to them should be limited, + because Ansible can leak administrative passwords and other secrets to + system log. The same leaked passwords can be observed in OpenSearch if + you're pushing your system logs there. + + Network configuration ~~~~~~~~~~~~~~~~~~~~~ diff --git a/doc/source/reference/bare-metal/ironic-guide.rst b/doc/source/reference/bare-metal/ironic-guide.rst index fbbe00ff2..962ece762 100644 --- a/doc/source/reference/bare-metal/ironic-guide.rst +++ b/doc/source/reference/bare-metal/ironic-guide.rst @@ -146,6 +146,22 @@ The port used for conductor's HTTP server is controlled via ironic_http_port: "8089" +Configure Ironic Python Agent NTP server (optional) +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +The Ironic Python Agent requires that the system clock is set correctly for +the heartbeat mechanism to work. One way of achieving this is to pass +the address of an NTP server via the kernel commandline, which is then +used to set the system clock when IPA first starts. This is not a hard +requirement, and you may use other methods. For example DHCP, or functionality +built into the BMC. + +If you wish to use this option you can set ``ironic_ntp_server`` in +``/etc/kolla/globals.yml``. Eg. + +.. code-block:: yaml + + ironic_ntp_server: "192.168.33.3" + Revert to plain PXE (not recommended) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Starting with Yoga, Ironic has changed the default PXE from plain PXE to iPXE. diff --git a/doc/source/reference/databases/mariadb-guide.rst b/doc/source/reference/databases/mariadb-guide.rst index e34e4bf0a..c4a40740e 100644 --- a/doc/source/reference/databases/mariadb-guide.rst +++ b/doc/source/reference/databases/mariadb-guide.rst @@ -22,7 +22,7 @@ an independent Galera cluster. This section explains how to configure multiple database shards. Currently, only one shard is accessible via the HAProxy load balancer and supported -by the ``kolla-ansible mariadb_backup`` command. This will be improved +by the ``kolla-ansible mariadb-backup`` command. This will be improved in future by using ProxySQL, allowing load balanced access to all shards. Deployment diff --git a/doc/source/reference/logging-and-monitoring/grafana-guide.rst b/doc/source/reference/logging-and-monitoring/grafana-guide.rst index 12f123a20..6f89c2016 100644 --- a/doc/source/reference/logging-and-monitoring/grafana-guide.rst +++ b/doc/source/reference/logging-and-monitoring/grafana-guide.rst @@ -9,7 +9,7 @@ Overview `Grafana <https://grafana.com>`_ is open and composable observability and data visualization platform. Visualize metrics, logs, and traces from -multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, +multiple sources like Prometheus, Loki, Elasticsearch, Postgres and many more.. Preparation and deployment @@ -30,6 +30,55 @@ If you would like to set up Prometheus as a data source, additionally set: Please follow :doc:`Prometheus Guide <prometheus-guide>` for more information. +LDAP Authentication +~~~~~~~~~~~~~~~~~~~ + +Grafana can be configured to use LDAP for user authentication. To enable this +feature, set the following variable in ``/etc/kolla/globals.yml``: + +.. code-block:: yaml + + grafana_ldap_enabled: true + +The configuration for the LDAP server should be provided in a ``ldap.toml`` +file placed in the ``{{ node_custom_config }}/grafana/`` folder on the control +host. + +Example ``ldap.toml`` configuration: + +.. code-block:: ini + + [[servers]] + host = "openstack.org" + port = 389 + use_ssl = false + start_tls = true + + bind_dn = "CN=svc-openstack-grafana,OU=serviceaccounts,DC=openstack,DC=org" + bind_password = "strong_password" + + search_filter = "(sAMAccountName=%s)" + search_base_dns = ["OU=Users,DC=openstack,DC=org"] + + [servers.attributes] + name = "givenName" + surname = "sn" + username = "uid" + member_of = "memberOf" + email = "mail" + + [[servers.group_mappings]] + group_dn = "cn=grafana-admins,ou=groups,dc=openstack,dc=org" + org_role = "Admin" + + [[servers.group_mappings]] + group_dn = "cn=grafana-editors,ou=groups,dc=openstack,dc=org" + org_role = "Editor" + + [[servers.group_mappings]] + group_dn = "*" + org_role = "Viewer" + Custom dashboards provisioning ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/doc/source/reference/logging-and-monitoring/index.rst b/doc/source/reference/logging-and-monitoring/index.rst index 09d017547..05d0b96b7 100644 --- a/doc/source/reference/logging-and-monitoring/index.rst +++ b/doc/source/reference/logging-and-monitoring/index.rst @@ -10,6 +10,5 @@ logging and monitoring services available in kolla. central-logging-guide grafana-guide - influxdb-guide osprofiler-guide prometheus-guide diff --git a/doc/source/reference/logging-and-monitoring/influxdb-guide.rst b/doc/source/reference/logging-and-monitoring/influxdb-guide.rst deleted file mode 100644 index 6bb460d0c..000000000 --- a/doc/source/reference/logging-and-monitoring/influxdb-guide.rst +++ /dev/null @@ -1,28 +0,0 @@ -.. _influxdb-guide: - -=============================== -InfluxDB - Time Series Database -=============================== - -Overview -~~~~~~~~ - -InfluxDB is a time series database developed by InfluxData. It is -possible to deploy a single instance without charge. To use the -clustering features you will require a commercial license. - -InfluxDB -~~~~~~~~ - -The `recommendation <https://docs.influxdata.com/influxdb/v1.7/guides/hardware_sizing/#what-kind-of-storage-do-i-need>`_ -is to use flash storage for InfluxDB. If docker is configured to use -spinning disks by default, or you have some higher performance drives -available, it may be desirable to control where the docker volume is -located. This can be achieved by setting a path for -``influxdb_datadir_volume`` in ``/etc/kolla/globals.yml``: - -.. code-block:: yaml - - influxdb_datadir_volume: /mnt/ssd/influxdb/ - -The default is to use a named volume, ``influxdb``. diff --git a/doc/source/reference/logging-and-monitoring/prometheus-guide.rst b/doc/source/reference/logging-and-monitoring/prometheus-guide.rst index 4fb9855c8..d1e4109fc 100644 --- a/doc/source/reference/logging-and-monitoring/prometheus-guide.rst +++ b/doc/source/reference/logging-and-monitoring/prometheus-guide.rst @@ -239,7 +239,7 @@ For example: :caption: ``/etc/kolla/globals.yml`` prometheus_node_exporter_targets_extra: - - target: http://10.0.0.1:1234 + - target: 10.0.0.1:1234 labels: instance: host1 diff --git a/doc/source/reference/networking/neutron.rst b/doc/source/reference/networking/neutron.rst index 3994ed886..3fec073a5 100644 --- a/doc/source/reference/networking/neutron.rst +++ b/doc/source/reference/networking/neutron.rst @@ -286,6 +286,15 @@ convenient to run them from ``ovn_northd`` container: docker exec ovn_northd ovn-nbctl show +Additional command-line arguments can be passed to the ``ovn-northd`` daemon +using the ``ovn_northd_cmdline_extras`` variable. This can be useful for +tuning performance parameters: + +.. path /etc/kolla/globals.yml +.. code-block:: yaml + + ovn_northd_cmdline_extras: "--n-threads=8 --use-parallel-build --inactivity-probe=10000" + Mellanox Infiniband (ml2/mlnx) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/doc/source/reference/rating/cloudkitty-guide.rst b/doc/source/reference/rating/cloudkitty-guide.rst index 061e09675..dbe88b9c7 100644 --- a/doc/source/reference/rating/cloudkitty-guide.rst +++ b/doc/source/reference/rating/cloudkitty-guide.rst @@ -60,7 +60,7 @@ Cloudkitty Storage Backend ~~~~~~~~~~~~~~~~~~~~~~~~~~ As for collectors, CloudKitty supports multiple backend to store ratings. -By default, Kolla Ansible uses the InfluxDB based backend. +By default, Kolla Ansible uses the SQLAlchemy based backend. Another famous alternative is OpenSearch and can be activated in Kolla Ansible using the ``cloudkitty_storage_backend`` configuration option in diff --git a/doc/source/user/quickstart.rst b/doc/source/user/quickstart.rst index b4d855367..f02401fc2 100644 --- a/doc/source/user/quickstart.rst +++ b/doc/source/user/quickstart.rst @@ -261,7 +261,7 @@ There are a few options that are required to deploy Kolla Ansible: * Virtual environment It is recommended to use a virtual environment to execute tasks on the remote - hosts. This is covered + hosts. This is covered in :kolla-ansible-doc:`Virtual Environments <user/virtual-environments.html>`. Deployment |