aboutsummaryrefslogtreecommitdiff
path: root/doc/source/admin
AgeCommit message (Collapse)AuthorFilesLines
2026-04-17docs: add Rocky Linux 10 migration guideBartosz Bezak1-0/+2
Change-Id: Ief8b52e57c156023bd2b704967c769c77b37687e Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-04-10[stable-2025.1] valkey: Add subcommand for migration from RedisMichal Nasiadka1-0/+55
Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Change-Id: I808a0fc6886036be20a4fcf43991b3bd92a52f23 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-04-10[stable-2025.1] valkey: Add ansible roleMichal Nasiadka1-0/+1
This is a non-trivial backport of Valkey deployment that is required for migration to Rocky Linux 10 before upgrading to Flamingo/Gazpacho. Additional subcommand and playbook to migrate from Redis to Valkey will be added in a follow-up. Cephadm bits backported from I51823808c4e4ac08ae8f080aacf6a3759589571d Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Change-Id: I613d471e5f1e6d563d3853761d8432cba60f3c4c Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2026-03-30[2025.1 only] Support ProxySQL 3.0.x on 2025.1Seunghun Lee2-0/+55
ProxySQL bug [1] on certificate chain send is decided not to be fixed for 2.7.x. As ProxySQL is the default loadbalancer for MariaDB from 2025.1, add support for ProxySQL 3.0.x to get the fix. [1] https://github.com/sysown/proxysql/issues/4877 Change-Id: I0e164b5f2a56f9dbc495046f0b3053bb9edf7fd3 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com> Depends-on: https://review.opendev.org/c/openstack/kolla/+/974429
2026-01-19docs: Add information about possible password leakingMichal Nasiadka1-0/+10
Closes-Bug: #2120302 Change-Id: Ideb7974796ba503a2ac979a321b9c6f27c7c22a1 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com> (cherry picked from commit e566fbf6de9b306be8b5c895f2ed091c0bca8bc5)
2025-12-07Fix incorrect mariadb-recovery task name in error messageVudn1-1/+1
Closes-Bug: #2133983 Change-Id: Ib79cd622123d9b6727ab1d674f680b8e2d52ed68 Signed-off-by: Vudn <dangngocvu4@gmail.com> (cherry picked from commit adba7669509ed894fe73b145738712bdcdcdaade)
2025-08-14Set default external Let's Encrypt cert serverSeunghun Lee1-13/+20
Currently, unless users set either external or internal cert server by themselves, enabling Let's Encrypt with ``enable_letsencrypt`` does nothing. This change makes the external certificate get managed by Let's Encrypt by default when Let's Encrypt is enabled. The server address is default Let's Encrypt ACME server [1] which was the former default before change [2]. [1] https://acme-v02.api.letsencrypt.org/directory [2] https://review.opendev.org/c/openstack/kolla-ansible/+/925971 Closes-bug: #2120451 Change-Id: I10e800aede5966e030ed8e661e2eb45b126ff678 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com> (cherry picked from commit 15dc0d0ede49dcfbb3b0ce04e6e0d1f25abdf28e)
2025-05-08Merge "Add container engine migration scenario"Zuul1-0/+38
2025-04-01Merge "Fix reference to generating a private CA"Zuul1-3/+3
2025-03-21Remove Swift roleMichal Nasiadka2-13/+4
Since Swift is broken and since deprecation nobody did pick up the work to make it working - let's remove swift role and associated integrations/CI scripts. Change-Id: I08e92aaeea644053fd25f80ce1f276a495cebbfc
2025-03-19Add container engine migration scenarioKonstantin Yarovoy1-0/+38
Add "migrate-container-engine" action to kolla-ansible which changes the container engine on which the Openstack is deployed on. For example Docker to Podman and vice versa. Depends-on: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/925083 Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com> Signed-off-by: Roman Krček <roman.krcek@tietoevry.com> Change-Id: Icd709cb042d44e063c5da64ab0695b0b6ba6d48b
2025-01-22Fix reference to generating a private CAPierre Riteau1-3/+3
Also fix a typo while here. Change-Id: I65d058842fb1bdfccc41f5d7b5a175cdf4ef4969
2024-12-18Docs update - kolla-ansible cli parametersJakub Darmach3-9/+9
With rewrite of kolla-ansible CLI to Python in I9749b320d4f5eeec601a055b597dfa7d8fb97ce2 the order of parameters have to be: `kolla-ansible <action> <arguments>` Change-Id: I1bd4a7f96f77c34fb46ca21f37023dddf73e8f05 Closes-bug: 2087920
2024-11-25Fix TLS settings when letsencrypt turned onMichal Arbet1-0/+15
- Introduced `letsencrypt_managed_certs` variable to handle whether letsencrypt will generate internal, external or both certificates. - Updated certificate generation logic to use `letsencrypt_managed_certs` conditionally, replacing the previous `enable_letsencrypt` boolean. - Adjusted tasks and templates to support internal/external certificate management based on the new variable. - Enhanced Let's Encrypt script (`letsencrypt-lego-run.sh.j2`) to handle both internal and external certificates depending on VIP configurations. - Refined HAProxy configuration templates to correctly map certificates based on TLS settings and new management logic. Closes-bug: #2076331 Change-Id: Id80c7823fcc5d934b7369c7c0722cd78188e2ccf Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
2024-11-19Updates docs to fix incorrect container exampleAntony Messerli1-3/+3
Existing container was out of date and did not work for the db restore example. Updates to a rocky-9 example. Change-Id: I5f57467a18d3e42e0c71826cc3a7740110162af7
2024-08-30harden haproxy TLS configurationSven Kieske1-0/+26
harden the TLS default config according to the mozilla "modern" recommendation: https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=modern&openssl=1.1.1k&guideline=5.7 if you want to revert to the old settings, set: kolla_haproxy_ssl_settings: "legacy" in globals.yaml alternatively you can also set it to "intermediate" for a middle ground between security and accessibility. this also adjusts the glance and neutron tls proxy ssl settings in their dedicated haproxy config templates to use the same mechanism. also add some haproxy related docs to the TLS guide and cross reference it from the haproxy-guide. Closes-Bug: #2060787 Signed-off-by: Sven Kieske <kieske@osism.tech> Change-Id: I311c374b34f22c78cc5bcf91e5ce3924c62568b6
2024-07-09Fix prechecks for interfaces with dashesMichal Nasiadka1-6/+0
Closes-Bug: #2070051 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/923544 Change-Id: I221eb136e77c61aef39e8646b48b927352d1419d
2024-02-21Add password rotation docs pageAlex-Welsh2-0/+296
Closes-Bug: #1793323 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/903178 Depends-On: https://review.opendev.org/c/openstack/kolla/+/902057 Change-Id: Ibebd6e04de215e1a1aaff52c55d28c4741af98f2
2023-11-29Update etcd docs and renoDr. Jens Harbott1-14/+17
Just some minor formatting and wording updates Change-Id: Ia42944512f8d14a1993bd4ae3d09f0f2ab431322
2023-11-28etcd: Add support for more scenariosJan Gutter2-0/+98
This commit addresses a few shortcomings in the etcd service: * Adding or removing etcd nodes required manual intervention. * The etcd service would have brief outages during upgrades or reconfigures because restarts weren't always serialised. This makes the etcd service follow a similar pattern to mariadb: * There is now a distiction between bootstrapping the cluster and adding / removing another member. * This more closely follows etcd's upstream bootstrapping guidelines. * The etcd role now serialises restarts internally so the kolla_serial pattern is no longer appropriate (or necessary). This does not remove the need for manual intervention in all failure modes: the documentation has been updated to address the most common issues. Note that there's repetition in the container specifications: this is somewhat deliberate. In a future cleanup, it's intended to reduce the duplication. Change-Id: I39829ba0c5894f8e549f9b83b416e6db4fafd96f
2023-11-07Add support for LetsEncrypt-managed certsJames Kirsch1-0/+29
Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106
2022-10-18Update RHEL family informationMarcin Juszkiewicz1-4/+4
Some time ago we dropped RHEL as one of possible options. During 'Zed' cycle we added Rocky Linux 9 as alternative to CentOS Stream 9. This change updates some mentions of both. Change-Id: I9ed93efcb7d1ff97b1c7d8342db8252aba2a9887
2022-07-27Remove the deprecated storage_interface varRadosław Piliszek1-6/+1
Change-Id: I63673761959a560e97c848f092f086ceba25839a
2022-05-31Merge "Improve MariaDB restore procedure"Zuul1-5/+19
2022-01-20Merge "Deprecate storage_interface variable"Zuul1-4/+5
2022-01-11Improve MariaDB restore procedurePiotr Parczewski1-5/+19
Change-Id: Id05122cb564f3e7475b2b76da8c111e2c72601b8
2022-01-03docs: adjust to current defaultsPiotr Parczewski1-3/+3
Change-Id: I2e6b6ecd3717ff0811b47892aad406376c89a18c
2021-12-23Deprecate storage_interface variableRadosław Piliszek1-4/+5
Per [1] and exchange on IRC. [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-December/026437.html Change-Id: I322500e7204eb129d7bf085006627e8c4aaaa934
2021-05-25Merge "docs: Add note about internal VIP when HAProxy is disabled"Zuul1-0/+3
2021-04-19docs: Improve policy documentationMark Goddard1-14/+21
Change-Id: Iede747ceaafa54a00186761943fe2f4ac13f9559
2021-03-26Merge "Add `kolla_externally_managed_cert` option"Zuul1-0/+12
2021-03-25docs: Add note about internal VIP when HAProxy is disabledMark Goddard1-0/+3
Change-Id: I08030ac88911d3594c75cb2184767067ad177139
2021-03-02Add `kolla_externally_managed_cert` optionArthur Outhenin-Chalandre1-0/+12
This option disables copy of certificates from the operator host to kolla-ansible managed hosts. This is especially useful if you already have some mechanisms to handle your certificates directly on your hosts. Co-Authored-By: Marc 'risson' Schmitt <marc.schmitt@risson.space> Change-Id: Ie18b2464cb5a65a88c4ac191a921b8074a14f504
2021-01-27[docs] Unify project's naming conventionPiotr Parczewski1-2/+2
There are inconsitencies across the documentation and the source code files when it comes to project's name (Kolla Ansible vs. Kolla-Ansible). This commit aims at unifying it so that the naming becomes consistent everywhere. Change-Id: I903b2e08f5458b1a1abc4af3abefe20b66c23a54
2020-12-22Fix api_adress_family typoVictor Morales1-1/+1
Change-Id: Id93e7a91253b46e42d4817785d42ccc52564c330
2020-10-12Add support for encrypting backend Neutron API ServerJames Kirsch2-2/+6
Add TLS support for backend Neutron API Server communication using HAProxy to perform TLS termination. When used in conjunction with enabling TLS for service API endpoints, network communication will be encrypted end to end, from client through HAProxy to the Neutron service. Change-Id: Ib333a1f1bd12491df72a9e52d961161210e2d330 Partially-Implements: blueprint add-ssl-internal-network
2020-10-07Merge "Add support for ACME http-01 challenge"Zuul3-0/+45
2020-09-26Add support for ACME http-01 challengeRadosław Piliszek3-0/+45
All docs are included. Change-Id: Ie29ff7ca340812c8dc0dac493518c87cf7bf137b Partially-Implements: blueprint letsencrypt-https
2020-09-17Support TLS encryption of RabbitMQ client-server trafficMark Goddard1-0/+2
This change adds support for encryption of communication between OpenStack services and RabbitMQ. Server certificates are supported, but currently client certificates are not. The kolla-ansible certificates command has been updated to support generating certificates for RabbitMQ for development and testing. RabbitMQ TLS is enabled in the all-in-one source CI jobs, or when The Zuul 'tls_enabled' variable is true. Change-Id: I4f1d04150fb2b5af085b762890092f87ae6076b5 Implements: blueprint message-queue-ssl-support
2020-08-20remove obsolete configurationswu.chunyang1-9/+3
remove cluster_interface from project. update storage_interface docs.and remove storage_interface_address variable Change-Id: I3f811db988234f94b5ed0cc9d24233f70784f58d
2020-08-04Update TLS documentationJames Kirsch1-84/+277
Updated TLS documentation to reflect new features and configuration options added in Ussuri. Change-Id: I74550eaf394287b14fc521293cc4b5ea8074192c Partially-Implements: blueprint add-ssl-internal-network
2020-07-27Move TLS documentation to its own pageMark Goddard3-124/+130
Moved the TLS documentation from "advanced-configuration" doc to its own TLS document. This is in preparation for improving it. Change-Id: I4c83f1810ef1222aaa3560174c1ba39328853c4e Co-Authored-By: James Kirsch <generalfuzz@gmail.com>
2020-05-13Fix file extension in MariaDB backup docsPierre Riteau1-2/+2
Change-Id: I0495c1e33696cea36765f027bc453b9d3e8563e0
2020-05-07Merge "Update Advanced Config guide to clarify paths"Zuul1-1/+0
2020-04-30Add support for encrypting Glance apiJames Kirsch1-0/+4
Add TLS support for Glance api using HAProxy to perform TLS termination. Change-Id: I77051baaeb5d3f7dd9002262534e7d35f3926809 Partially-Implements: blueprint add-ssl-internal-network
2020-04-20Update Advanced Config guide to clarify pathsRaimund Hook1-1/+0
This update clears up an additional path that was mentioned in the Advanced Configuration documentation, but not actually picked up in the playbooks. This specifically affects Service Configuration overrides. The docs have been cleaned up to reflect the way the playbooks pick up the override files. Change-Id: Id15fe139af6462217c2ac26d7d21c5eac5368e12 Closes-Bug: 1873782 Signed-off-by: Raimund Hook <openstack@sting-ray.za.net>
2020-04-09Add support for encrypting backend Keystone HAProxy trafficJames Kirsch1-3/+8
This patch introduces an optional backend encryption for Keystone service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Keystone service. Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519 Partially-Implements: blueprint add-ssl-internal-network
2020-02-11Remove kolla-cephMichal Nasiadka1-1/+1
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1]. This change removes the Ansible code and associated CI jobs. [1]: https://review.opendev.org/669214 Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
2020-01-28Generate self signed TLS certificatesJames Kirsch1-3/+4
Generate both internal and external self signed TLS certificates. Duplicate the certificate if internal and external VIPs are the same. Change-Id: I16b345c0b29ff13e042eed8798efe644e0ad2c74 Partially-Implements: blueprint custom-cacerts
2020-01-28Copy CA into containers.James Kirsch1-0/+26
When kolla_copy_ca_into_containers is set to "yes", the Certificate Authority in /etc/kolla/certificates will be copied into service containers to enable trust for that CA. This is especially useful when the CA is self signed, and would not be trusted by default. Partially-Implements: blueprint custom-cacerts Change-Id: I4368f8994147580460ebe7533850cf63a419d0b4
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-14 02:12:44 +0000