aboutsummaryrefslogtreecommitdiff
path: root/ansible/post-deploy.yml
AgeCommit message (Collapse)AuthorFilesLines
2026-04-14Break out clouds.yaml/openrc creation from common roleMichal Nasiadka1-5/+5
It currently only holds kolla-toolbox and due to introducing clouds.yaml for kolla-toolbox usage we should separate these two for readability. Change-Id: I0b4d3b8ab199260cd5087c10cf916f9d43f346cc Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-19ansible-lint: Fix fqcn[actions-core] in playbooksMichal Nasiadka1-8/+8
Also add all failed roles into ignore and these will be removed in subsequent patches Change-Id: Ifa6f2725cfa93cb14d72daf27448bd58f186acfd Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-09ansible-lint: fix unnamed-task in post-deploy.ymlBertrand Lanson1-1/+2
Change-Id: Ia5ae6ffc11b99a2c93c9aba567ad28913b042fbb Signed-off-by: Bertrand Lanson <bertrand.lanson@protonmail.com>
2025-11-28ansible-lint: Remove yaml[truthy] from excludesMichal Nasiadka1-1/+1
Normalize quotes and some other easy fixes done by ansible-lint --fix Also drop etc from excludes and ignore comment check in etc/kolla/globals.yml Pinning to ansible-lint<25.11.0 because 25.11.1 is breaking without any messages Change-Id: I7dee3866191cef84cd12b1816cdab0a02380ec7f Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-11-06ansible-lint: Fix yaml[octal-values]Michal Nasiadka1-5/+5
Change-Id: I0c55f924489657ddcdb2957070cd69563c6d9886 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-05-14Fix unconditional use of become in post-deployWill Szumski1-1/+1
This must have snuck in after we landed the linked related change. Related-ID: Ied5ef4e1e3c9346342962d44de26702522b06b86 Related-Bug: #2098887 Change-Id: I9b0d67ba443a680f0eaa4f2ad5bb7137faf396de
2025-05-09Merge "Allow to run post-deploy without privilege escalation"Zuul1-13/+19
2025-02-19Allow to run post-deploy without privilege escalationMariusz Karpiarz1-13/+19
In deployments where `kolla-ansible` is run by a regular user, `post-deploy` could fail when attempting to create the `/etc/openstack` directory if privilege escalation is not enabled/possible non-interactively. With this change, we can run `post-deploy` with `become: false` if root is not the owner of the `node_config` directory. This change also removes the task creating `/etc/openstack` as this directory is unused since the change moving the cloud config file to `node_config`. Related-Id: Idd458ad6ef29e4eee2f9e537b4eae39d26eb9f64 Closes-Bug: #2098887 Change-Id: Ied5ef4e1e3c9346342962d44de26702522b06b86
2024-12-12Generate system scoped public-openrcPierre Riteau1-0/+9
It can be useful to run Ironic commands on the public API if access to the internal API is not possible. Related-Bug: #2051837 Change-Id: Ice0eb62f2bb26ca6e3ac8d02c6ea787b60408a86
2024-02-15Template system scoped admin-openrc and clouds.yml filesBartosz Bezak1-0/+9
Ironic enabled secure RBAC with system scoped enforcement [1]. Some API calls, for instance 'baremetal:driver:get' needs system scope role by design [2], even with elevated access project scope service role [3]. [1] https://review.opendev.org/c/openstack/ironic/+/902009 [2] https://opendev.org/openstack/ironic/src/commit/8ec56066223301230ac0ed0f0c471a10d366b474/ironic/common/policy.py#L1349-L1357 [3] https://review.opendev.org/c/openstack/kolla-ansible/+/908007 Related-Bug: #2051837 Change-Id: Id6313d7dd343b82d4c9ccf7bf429d340ea0e93d1
2022-10-20post-deploy: add public-openrc.shMichal Nasiadka1-0/+9
Change-Id: Ia19a00afc4bd1f79a463c0aa14585e8047dd47f9
2022-09-27Change clouds.yaml locationMichal Nasiadka1-1/+1
It's a followup to 73a1812c5856be635827b6c6de81b39c22346457 addressing post-merge comments. Change-Id: Idd458ad6ef29e4eee2f9e537b4eae39d26eb9f64
2022-08-08Add clouds.yaml file and use itMonty Taylor1-0/+21
clouds.yaml[0] is a richer way to express configuration for OpenStack clouds. It's also fully supported by Ansible's OpenStack modules as well as python-openstackclient and openstacksdk. It's the future - who doesn't like the future? Write a file using both the public (default) and the internal endpoints for the admin user. Also, change all of the examples to reference it and to get python-openstackclient to use it too. [0] https://docs.openstack.org/openstacksdk/latest/user/guides/connect_from_config.html Implements: blueprint use-clouds-yaml Change-Id: I557d2e4975c7b3d3c713a556b9ba47af9567ce6e
2021-06-23Use ansible_facts to reference factsMark Goddard1-2/+2
By default, Ansible injects a variable for every fact, prefixed with ansible_. This can result in a large number of variables for each host, which at scale can incur a performance penalty. Ansible provides a configuration option [0] that can be set to False to prevent this injection of facts. In this case, facts should be referenced via ansible_facts.<fact>. This change updates all references to Ansible facts within Kolla Ansible from using individual fact variables to using the items in the ansible_facts dictionary. This allows users to disable fact variable injection in their Ansible configuration, which may provide some performance improvement. This change disables fact variable injection in the ansible configuration used in CI, to catch any attempts to use the injected variables. [0] https://docs.ansible.com/ansible/latest/reference_appendices/config.html#inject-facts-as-vars Change-Id: I7e9d5c9b8b9164d4aee3abb4e37c8f28d98ff5d1 Partially-Implements: blueprint performance-improvements
2020-10-08add octavia openrc filewu.chunyang1-0/+5
we use octavia user to upload image currently, so it is better to create a octavia openrc file for user Implements: blueprint implement-automatic-deploy-of-octavia Change-Id: Ib53d00fa4a6ee59b8a0b2245f83786a6af0cbf53
2020-08-19Fix ownership and permissions of admin-openrc.shlikui1-2/+4
Previously the post-deploy.yml playbook was executed with become: true, and the admin-openrc.sh file templated without an owner or mode specified. This resulted in admin-openrc.sh being owned by root with 644 permissions. This change creates the file without become: true, and explicitly sets the owner to the user executing Ansible, and the mode to 600. Co-Authored-By: Mark Goddard <mark@stackhpc.com> Closes-Bug: #1891704 Change-Id: Iadf43383a7f2bf377d4666a55a38d92bd70711aa
2020-08-12Revert "Fix post-deploy mode"Radosław Piliszek1-1/+0
This fix was premature as it completely ignores the previously-respected umask. Let's discuss a proper fix and revert this one since CI is fixed elsewhere [1]. [1] https://review.opendev.org/743502 This reverts commit 87efdce24bc802777d4da58f9f63c8d0838e7120. Change-Id: If38adbf124e793574a21ae986f9ee146d587f820
2020-08-11Fix post-deploy modeRadosław Piliszek1-0/+1
Ansible changed the default mode for files, even in stable releases. [1] This change restores the previous default (with the common umask). [1] https://github.com/ansible/ansible/pull/70221 Change-Id: I0f81214b4f95fe8a378844745ebc77f3c43027ab Closes-Bug: #1891145
2020-05-12Ansible lint related fixesMichal Nasiadka1-1/+2
Change-Id: I146ea3d84efb83ec5d7405644ad372e57ecafc1e
2018-11-19Use correct variable for default certificate pathscaoyuan1-1/+1
The variable {{ node_config_directory }} is used for the configuration directory on the remote hosts, and should not be used for paths on the deploy host (localhost). This changes the default value of the TLS certificate and CA file to reference {{ CONFIG_DIR }}, in line with the directory used for admin-openrc.sh (as of I0709482ead4b7a67e82796e17f85bde151e71bc0). This change also introduces a variable, {{ node_config }}, that references {{ CONFIG_DIR | default('/etc/kolla') }}, to remove duplication. Change-Id: Ibd82ac78630ebfff5824c329d7399e1e900c0ee0 Closes-Bug: #1804025
2017-10-12post-deploy: honour --config-dir argumentMarcin Juszkiewicz1-1/+1
kolla-ansible can take globals.yml from any directory by using --config-dir argument. So store admin credentials there as well. Not everyone runs kolla-ansible as a root. Change-Id: I0709482ead4b7a67e82796e17f85bde151e71bc0
2017-09-25Specify 'become' to necessary tasks (general roles)Duong Ha-Quang1-0/+1
Add config_owner_user and config_owner_group to group_vars/all, which is user and group of Kolla configuration files in /etc/kolla. Add become to post-deploy playbook. Add become to only neccesary tasks in roles: - certificate - common - destroy - haproxy - mariadb - memcached - rabbitmq Change-Id: I2aba745a6e3928c52642f64551470fd08cbfd058 Partial-Implements: blueprint ansible-specific-task-become
2017-03-09Modify the hosts of the post-deploy.yml playbookzhuzeyu1-2/+1
The admin-openrc.sh should copy to where the python-openstackclient was installed. whatever multinode and all-in-one, the place where python-openstackclient was installed is localhost, So admin-openrc.sh should copy to localhost. The purpose of "connection: local" in ansible playbook is that make sure this script can copy to localhost.In all-in-one, Writting as this is ok, it will copy to localhost, but in multinode, this will make a bug, add ansible_connection=ssh in inventory file the admin-openrc.sh will not copy to the localhost,the "connection:local" in post-deploy.yml will be covered by "ansible_connection=ssh" in inventory file, then the script will be copied to target node. So we should modify the hosts to localhost to avoid this bug. Change-Id: I054717cc2b4adc600808282034a10a58c1184a38 Closes-Bug: #1666808
2015-11-23Create openrc file on the deploy nodeHui Kang1-0/+9
This task is run as a post-deploy playbook Implements: blueprint ansible-task-generate-openrc Change-Id: I69f4ee895094da5c73494a41dccb2e86eb481656
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 16:00:39 +0000