aboutsummaryrefslogtreecommitdiff
path: root/ansible/library
AgeCommit message (Collapse)AuthorFilesLines
2026-07-30Ensure OpenSearch waits for recovery during upgradeAlex Welsh1-1/+8
Change-Id: I8825f41a1753eb323e0fdf1bf38a679670e01ba7 Signed-off-by: Alex Welsh <alex@stackhpc.com> (cherry picked from commit 37194fcab7883b8626f2eab5a4f6a19246b85ec9)
2026-06-22fix kolla_toolbox running with wrong HOME envBertrand Lanson1-1/+4
There is a possibility that the ansible-runner in kolla_toolbox is executed with the wrong environment variables if run in a specific way. The cause is not super clear, but the solution is to simply force it to use the correct HOME value. Closes-Bug: #2153544 Change-Id: Ibad84e358f21564c570161f7e4f21b117398df3b Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com> (cherry picked from commit 2104f74a2616821c2bd848411ebfce266a3edd69)
2026-03-25kolla_toolbox: fix secrets leakingMichal Nasiadka1-97/+301
Replace ansible CLI invocation with ansible-runner, passing module args via put_archive tar stream instead of exec argv. Override _log_invocation to add no_log values to relevant variables on module invocation (without that we leak secrets on each module invocation - check for "Invoked with" syslog entries) runner_on_skipped is required for --check support Requires ansible-runner in the kolla_toolbox image (Depends-On). Depends-On: https://review.opendev.org/c/openstack/kolla/+/980788 Closes-Bug: #2131197 Closes-Bug: #2138622 Assisted-By: Claude Sonnet 4.6 Change-Id: I110f79aa911b746d13f6648883191edabea10563 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-01-19CI: Fix hardcoded passwords check introduced by banditMichal Nasiadka1-1/+1
Tests had to be a bit refactored due to pep8 E501 (line too long) See [1]. [1]: https://github.com/PyCQA/bandit/commit/649b9bdf87f4f9d850b29819b14b847bd3b8f970 Change-Id: I99407525546f50c4ff1c0101316485604c83b07f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-12kolla_toolbox: Add support for deprecation warningsMichal Nasiadka1-1/+17
ansible-core 2.20 introduced some deprecation warnings in internal module functions and not all modules have adapted to new functionality, therefore kolla_toolbox invocations contain both deprecation warnings (or other warnings) and JSON blocks. This patch adds support for separating these and printing deprecation warnings using warn() function in AnsibleModule Closes-Bug: #2138234 Change-Id: I2008d9d8c85b2216036f5155e29f7e5db43832f0 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-01Add ability to get stopped container's factsRoman Krček1-10/+49
kolla_container_facts could only get running containers, this patch adds the ability to specify, that user wants even stopped containers. Also updates module's docs and corrects few typos. Change-Id: I9ace3c1d802bc00ce692b3ca755384c6b62bd72d Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2025-08-13Revert "security: hide sensitive auth_password in kolla_container module logs"Michal Nasiadka1-2/+1
This reverts commit 9e8b2c4661416e7812afa70bad144201ea410fe9. Reason for revert: no_log=True on common_options over-redacts, including parsed stdout, breaking CI. Different approach needed. Change-Id: Ia1a1a247c72b0edb13a26f3f73259abe4f92b762 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-12security: hide sensitive auth_password in kolla_container module logsPiotr Milewski1-1/+2
Added no_log=True to the 'common_options' argument in generate_module() to prevent the auth_password and other sensitive data from being printed in Ansible logs during container operations. This improves security by hiding credentials from logs. This change addresses the issue where auth_password was visible in logs despite already having no_log=True on the auth_password parameter itself, because it was nested inside common_options dict without no_log protection. Closes-Bug: #2120302 Change-Id: I2064f822bda1c2618605ecfb9bf26ad820ccbbf2 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2025-04-01Merge "Move kolla_toolbox to high level client"Zuul1-167/+179
2025-03-31Move kolla_toolbox to high level clientRoman Krček1-167/+179
Move from APIClient to PodmanClient and DockerClient clients. Signed-off-by: Roman Krček <roman.krcek@tietoevry.com> Change-Id: I6c5734b6fff1bd42929851a263620bb4d959ac25
2025-03-24Merge "Add action for getting container names list"Zuul1-1/+13
2025-03-21Remove Swift roleMichal Nasiadka1-4/+4
Since Swift is broken and since deprecation nobody did pick up the work to make it working - let's remove swift role and associated integrations/CI scripts. Change-Id: I08e92aaeea644053fd25f80ce1f276a495cebbfc
2025-03-19Add action for getting container names listIvan Halomi1-1/+13
This patch adds a new action to kolla_container_facts module, which retrieves list of names of all containers. It is intended to be an alternative to using "docker ps -a" type of commands in the Ansible code. Change-Id: I9c04d6fe77f20e5aa832684bd65de95d161cd8ea Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com>
2025-03-19Merge of container_facts modulesIvan Halomi2-110/+30
Merge container_facts and container_volume_facts into a single module for retrieving all information about containers and volumes. Change-Id: I5d321b8326edd7f3b7a11dbdc821e534f457f9d7 Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com> Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2025-02-14Fix kolla_container_facts performanceRoman Krček1-0/+3
If a container has been running for some time, it will accumulate MBs worth of healthcheck logs that kolla_container_facts module will forward to ansible when action "get_container" is called. That causes the execution of this module to slow down considerably. Change-Id: I6b11672ba093c65cef4d20f8ef716e459c2a92c3 Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2025-02-07Move actions to kolla_container_factsIvan Halomi2-58/+100
Move actions responsible for info about containers from kolla_container module to kolla_container_facts. Also fixes a bug with inconsistencies between docker and podman in kolla_container_facts. Closes-bug: #2084878 Change-Id: I1db88e28a828ebf073f018b2bae1d9556ec22807 Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com> Signed-off-by: Martin Hiner <martin.hiner@tietoevry.com> Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2024-12-01Refactor services' check-containers and optimiseRadosław Piliszek1-0/+2
This might fix some hidden bugs where the check tasks forgot to include params important for the service. We also get a nice optimisation by using a filtered loop instead of task skipping per service with 'when'. As proven in https://review.opendev.org/c/openstack/kolla-ansible/+/914997 This refactoring allows for further optimisation and fixing work to proceed with much less hassle. Including getting rid of many notify statements as the restarts are now safely handled by check-containers. Some notifies had to stay, because of special edge cases eg. in rolling upgrades and loadbalancer config. One downside is we remove the little optimisation for Zun that ignored config change for copying loopback but this is an acceptable tradeoff considering the benefits above. Co-Authored-By: Roman Krček <roman.krcek@tietoevry.com> Change-Id: I855dfef33aa0f3fd1301295bb8ede3e587e7162a Partially-Implements: blueprint performance-improvements
2024-11-16Merge "Use new module names from openstack.cloud"Zuul1-1/+1
2024-09-12Separate outputs of kolla_toolbox inner modulePierre Riteau1-1/+3
Inner modules called by the kolla_toolbox module were returning stdout and stderr as a single output object. This could break JSON parsing if any data was present in stderr, for example warnings such as: [WARNING]: Collection ansible.posix does not support Ansible version 2.14.17 Fix by using demux=True to separate the two streams. The stderr content is logged as it could be useful for troubleshooting or catching deprecation notices. Change-Id: Iad0476d4511f28c837794352c9a3e2f47113d9a1 Closes-Bug: #2080544
2024-08-27Use new module names from openstack.cloudMichal Nasiadka1-1/+1
All of them have been renamed 4 years ago [1]. https: //review.opendev.org/c/openstack/ansible-collections-openstack/+/726538 Change-Id: I23525c35e3f6e4a4a611e97e01cab97750199aef
2024-08-21Remove "distutils" libraryleiyashuai1-88/+42
Library "distutils" is deprecated in Python 3.10: https://peps.python.org/pep-0632/ The versions previously referenced using StrictVersion should be old enough that they will not be used in a Dalmatian deployment: - Ansible 2.11 - Docker API 1.42, included since Docker engine 23.0.0 Change-Id: Ie315004715a1cb5a91dd54bc64b0a8fd0af650ec
2024-08-12Refactor of kolla_container_factsIvan Halomi1-53/+89
Refactor that prepares kolla_container_facts module for introducing more actions that will be moved from kolla_container module and kolla_container_volume_facts. This change is based on a discussion about adding a new action to kolla_container module that retrieves all names of the running containers. It was agreed that kolla-ansible should follow Ansible's direction of splitting modules between action modules and facts modules. Because of this, kolla_container_facts needs to be able to handle different requests for data about containers or volumes. Change-Id: Ieaec8f64922e4e5a2199db2d6983518b124cb4aa Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com>
2024-03-20Fix incorrect condition in kolla_container_factsMartin Hiner1-1/+1
Incorrect condition in Podman part prevented the retrieval of facts of all the containers when no names were provided. Closes-Bug: #2058492 Change-Id: I6d7f7ca0523eb17c7d9a9b93d2037bf77f2c2a47 Signed-off-by: Martin Hiner <martin.hiner@tietoevry.com>
2023-11-15Rename kolla_docker to kolla_containerMartin Hiner1-9/+9
Changes name of ansible module kolla_docker to kolla_container. Change-Id: I13c676ed0378aa721a21a1300f6054658ad12bc7 Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com>
2023-11-14Introduce oneshot docker_restart_policyMichal Nasiadka1-0/+2
docker_restart_policy: no causes systemd units to not get created and we use it in CI to disable restarts on services. Introducing oneshot policy to not create systemd unit for oneshot containers (those that are running bootstrap tasks, like db bootstrap and don't need a systemd unit), but still create systemd units for long lived containers but with Restart=No. Change-Id: I9e0d656f19143ec2fcad7d6d345b2c9387551604
2023-11-09Fix kolla_docker moduleMichal Arbet1-0/+8
Change-Id: I7df734cf15eba1af4da92f9c4ef12cc761442ca1
2023-10-20Add support of podman deploymentIvan Halomi4-43/+184
This change adds basic deployment based on Podman container manager as an alternative to Docker. Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com> Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com> Signed-off-by: Petr Tuma <p.tuma@partner.samsung.com> Change-Id: I2b52964906ba8b19b8b1098717b9423ab954fa3d Depends-On: Ie4b4c1cf8fe6e7ce41eaa703b423dedcb41e3afc
2023-10-04Default keystone user role changed to memberBartosz Bezak1-1/+1
_member_ role is a long not used default keystone role, for instance Horizon moved to use member role from yoga [1] [1] https://docs.openstack.org/horizon/yoga/configuration/settings.html#openstack-keystone-default-role Closes-Bug: #2038314 Change-Id: Idc9bce82c682e37c5bea10c93577091b85f3ad45
2023-09-05ovn: Improve clusteringMichal Nasiadka1-0/+91
Currently clustering steps are very static, if for a reason first node in the inventory fails and gets re-introduced - K-A will create a second empty cluster on that node. This patch changes the approach and checks if cluster exists, if it does - chooses a donor for the new node from currently running node set. Also it fixes node replacement - it removes old node from cluster (that has the same ip address as newly provisioned node). Closes-Bug: #1875223 Change-Id: Ia025283e38ea7c3bd37c7a70d03f6b46c68f4456
2023-02-20Refactor DockerWorker into ContainerWorkerIvan Halomi1-1/+3
Fourth part of patchset: https://review.opendev.org/c/openstack/kolla-ansible/+/799229/ which was suggested to be split into smaller patches. This commit refactors select methods from DockerWorker class into ContainerWorker class. New class contains Docker independent methods also used in Podman introduction and is inteded as a parent class for specific worker classes. Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com> Co-authored-by: Martin Hiner <m.hiner@partner.samsung.com> Change-Id: I2dd5920410dda053f2dfedc4e2666c56b1a7095a
2023-02-04Fix kolla_docker moduleMichal Arbet1-13/+38
This patch fixes kolla_docker module as it did not take into account common_options parameter. From patchset it's visible that module's default values are used always - even if user overrided some param in common_options dict. Closes-Bug: #2003079 Change-Id: I677fde708dd004decaff4bd39f2173d8d81052fb
2022-12-13Remove shebang to properly support venv in ansible-core 2.13+Michal Nasiadka3-6/+0
See https://github.com/ansible/ansible/pull/76677 Change-Id: If822dcfc4c1abf7a22be35ffd90fd05ee46cb0d9
2022-11-04Adding container_engine to kolla_toolbox moduleIvan Halomi1-0/+9
Second part of patchset: https://review.opendev.org/c/openstack/kolla-ansible/+/799229/ in which was suggested to split patch into smaller ones. THis change adds container_engine to module parameters so when we introduce podman, kolla_toolbox can be used for both engines. Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com> Co-authored-by: Martin Hiner <m.hiner@partner.samsung.com> Change-Id: Ic2093aa9341a0cb36df8f340cf290d62437504ad
2022-11-02Adding container engine to kolla_container_factsIvan Halomi1-1/+8
Second part of patchset: https://review.opendev.org/c/openstack/kolla-ansible/+/799229/ in which was suggested to split patch into smaller ones. This change adds container_engine variable to kolla_container_facts module, this prepares module to be used with docker and podman as well without further changes in roles. Signed-off-by: Ivan Halomi <i.halomi@partner.samsung.com> Co-authored-by: Martin Hiner <m.hiner@partner.samsung.com> Change-Id: I9e8fa30646844ab4a288555f3aafdda345b3a118
2022-10-04Bump Ansible min version to 2.12/5 and max to 2.13/6Michal Nasiadka3-3/+3
Change-Id: Ie09bf108250a71d539002dd5ccfa63dd71bcfe90
2022-02-14Remove bslurp moduleMark Goddard1-215/+0
This module was used in the Ceph deployment support, which was removed long ago. Change-Id: I599ef47199bc68e8f5cf62709157d3f096ac68a9
2022-01-06Refactor of kolla_docker into module_utilsMartin1-861/+1
Moved the DockerWorker class from module file into its separate file in module_utils directory for future extension. Unit tests changed accordingly. Signed-off-by: Ivan Halomi <ivan.halomi@tietoevry.com> Co-authored-by: Martin Hiner <martin.hiner@tietoevry.com> Change-Id: Ia2a471a9a2805e13b2c20dbf8a7297c23231aae3
2021-09-23Bump up Ansible max supported ver to 4.xMichał Nasiadka1-1/+7
This change bumps up max supported Ansible version to 4.x (ansible-core 2.11.x) and minimum to 2.10. Change-Id: I8b9212934dfab3831986e8db55671baee32f4bbd
2021-08-05Merge "Check config when checking the containers"Zuul1-1/+43
2021-05-30[docker] Add support for setting CgroupnsModeRadosław Piliszek1-1/+43
This is required to support Debian Bullseye (11) - need to set nova-libvirt to use 'host' CgroupnsMode. Change-Id: I40213d4092fa325bcf37bb1fb4437ab125fe328b
2021-04-27Check config when checking the containersRadosław Piliszek1-1/+43
The proposed approach allows for checking whether config files are current, e.g. cases when the deployment was aborted after config files were generated but before they were injected into the containers which lead to old config staying in containers. After this patch we can do: kolla-ansible genconfig kolla-ansible deploy-containers and it would do what we expected rather than being a noop in the second part. We also lose the need to have notifies and whens in config and handler sections respectively. This is optimised in a separate patch. Future work: - optimise for large files - could we get away with comparing timestamps and sizes? container's should have a newer timestamp due to copy, could also preserve it Change-Id: I1d26e48e1958f13b854d8afded4bfba5021a2dec Closes-Bug: #1848775 Depends-On: https://review.opendev.org/c/openstack/kolla/+/773257 Co-Authored-By: Mark Goddard <mark@stackhpc.com>
2020-12-16Add support to kolla_docker for tmpfs mountsMark Goddard1-0/+26
Partial-Bug: #1897276 Change-Id: Ia06da456a7f26f0f2ceebc35eb88c0da0767e1c6
2020-10-04Coordinate haproxy and keepalived restartsRadosław Piliszek1-2/+5
Keepalived and haproxy cooperate to provide control plane HA in kolla-ansible deployments. Certain care should be exerted to avoid prolonged availability loss during reconfigurations and upgrades. This patch aims to provide this care. There is nothing special about keepalived upgrade compared to reconfig, hence it is simplified to run the same code as for deploy. The broken logic of safe upgrade is replaced by common handler code which's goal is to ensure we down current master only after we have backups ready. This change introduces a switch to kolla_docker module that allows to ignore missing containers (as they are logically stopped). ignore_missing is the switch's name. All tests are included. Change-Id: I22ddec5f7ee4a7d3d502649a158a7e005fe29c48
2020-09-30Add healthchecks option to kolla_dockerMichal Nasiadka1-2/+106
blueprint container-health-check Implements healthchecks option in kolla_docker Ansible module Change-Id: I9323d4e75378d06f52b869f31009fd656bf270d2
2020-05-17Enable W503 for flake8 checkgugug1-2/+2
W503 and W504 are incompatible and we need to choose one of them. Existing codes follows W503, so we disable W504. Change-Id: Ic745e956dd332eb0fa49b93c1e6acb12f8a7f26c
2020-04-04Update hacking for Python3Andreas Jaeger1-5/+5
The repo is Python 3 now, so update hacking to version 3.0 which supports Python 3. Fix problems found by updated hacking version. Remove hacking and friends from lower-constraints, they are not needed during installation. Change-Id: I7ef5ac8a89e94f5da97780198619b6facc86ecfe
2020-02-11Remove kolla-cephMichal Nasiadka1-160/+0
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1]. This change removes the Ansible code and associated CI jobs. [1]: https://review.opendev.org/669214 Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
2020-01-06Fix duplicated words issue like "are are out of"zhufl1-1/+1
This is to fix the duplicated words issue like "Other services that are are out of scope of this". Change-Id: Ie4882dbb64d6e8774888b97895af20ba3855f0f8
2019-11-28Support configuration of Docker client timeoutMark Goddard1-1/+9
Adds support for configuration of the Docker client timeout via 'docker_client_timeout'. This change also increases the default timeout to 120 seconds, as we sometimes see timeouts in CI and heavily loaded or underpowered environments. Increasing 'docker_client_timeout' further may be helpful in cases where Docker reports 'Read timed out'. Change-Id: I73745771078cb2c0ebae2b1d87ba2c4c12958d82 Closes-Bug: #1809844
2019-11-14Attempt to pull image before stopping and removing containerMark Goddard1-0/+5
* Deploy services using kolla-ansible deploy * Reconfigure the image for one or more services to use an invalid * config * Deploy/reconfigure services using kolla-ansible reconfigure The invalid config could be a wrong docker registry, wrong image name, wrong tag, etc. The restart handler for the service fails, and the old container is left running. The restart handler for the service fails, and the old container is stopped and removed. This leaves the service in a broken state. This change fixes the issue by pulling the image if necessary prior to stopping and removing the container. Change-Id: I85b2a1b224d4c4d85c32c4922a2cd2c41171a1dc Closes-Bug: #1852572
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 16:00:39 +0000