aboutsummaryrefslogtreecommitdiff
path: root/doc/source/admin
AgeCommit message (Collapse)AuthorFilesLines
2026-04-28Merge "Remove warning from password rotation docs page"Zuul1-7/+0
2026-04-24Support multiple Nova Compute Ironic instancesDoug Szumski1-0/+107
Adds support for deploying multiple instances of the Nova Compute Ironic service on the same host. This is useful in large baremetal deployments, where the sharding and/or conductor group feature is used to scale out the service. A further patch to support deploying multiple Ironic conductor instances will follow. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Co-Authored-By: Bertrand Lanson <bertrand.lanson@protonmail.com> Change-Id: Ibbddfd87e831a3775c3ed66c80b18e5070cedc90 Signed-off-by: Doug Szumski <doug@stackhpc.com>
2026-04-12Fix: Update outdated documentationPiotr Milewski4-16/+26
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-01-15docs: fix mariadb client binaryPierre Riteau1-1/+1
This is for the same reason as an earlier fix to the mariadb role [1]. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/970265 Change-Id: Ib8c0e02866245ff1d35ccf6a0d3121d8eb9a4e48 Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2026-01-14Merge "docs: Add information about possible password leaking"Zuul1-0/+10
2026-01-14docs: Add information about possible password leakingMichal Nasiadka1-0/+10
Closes-Bug: #2120302 Change-Id: Ideb7974796ba503a2ac979a321b9c6f27c7c22a1 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-01-06Standardize naming for MariaDB recovery and backup filesPiotr Milewski1-2/+2
This commit addresses and corrects the inconsistency in naming across multiple files within the project. Specifically, the terms mariadb_recovery and mariadb_backup have been replaced with mariadb-recovery and mariadb-backup respectively to adhere to the project's naming conventions and improve clarity. Change-Id: I47b80eaa0dc0487f506b47ca065951b5140e0d62 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2025-12-12glance: Switch to use uWSGIMichal Nasiadka1-4/+0
Glance is removing their warning around running in WSGI [1], so let's switch. [1]: https://review.opendev.org/c/openstack/glance/+/963294 Change-Id: Iae2c5ef5251d6695daf3262ed208c4bd914d7fb3 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-06Fix incorrect mariadb-recovery task name in error messageVudn1-1/+1
Closes-Bug: #2133983 Change-Id: Ib79cd622123d9b6727ab1d674f680b8e2d52ed68 Signed-off-by: Vudn <dangngocvu4@gmail.com>
2025-11-06Replace Redis with ValkeyGrzegorz Koper1-1/+1
This change replaces Redis with Valkey, which is non-existent on Rocky Linux 10 / CentOS Stream 10 due to licensing issues. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Co-Authored-By: Michal Nasiadka <mnasiadka@gmail.com> Change-Id: Ifcc6ec6e943c20867d969b0bdb0e4cbac53eea1e Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com> Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-10-02Move to for Rocky Linux 10Michal Nasiadka1-3/+3
CephAdm, Octavia, OVN and NFV jobs are not added here, because these rely on Valkey/Redis available. Ironic jobs are not added, because ipxe.efi is not packaged in EL10 and needs a followup patch. Let's Encrypt jobs are also not added, due to ssl certificate validation errors. Depends-On: https://review.opendev.org/c/openstack/kolla/+/956554 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/961237 Change-Id: I51823808c4e4ac08ae8f080aacf6a3759589571d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-18Merge "neutron: Switch to uWSGI"Zuul1-4/+0
2025-08-18neutron: Switch to uWSGIMichal Nasiadka1-4/+0
Also split services into: - api - rpc-worker (only for ML2/OVS) - periodic-worker - ovn-maintenance-worker (only for ML2/OVN) Remove neutron-tls-proxy since it's not needed anymore Change-Id: Iac99be59139eeb232dd3b00ec90fae0a4ea7547d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-13Set default external Let's Encrypt cert serverSeunghun Lee1-13/+20
Currently, unless users set either external or internal cert server by themselves, enabling Let's Encrypt with ``enable_letsencrypt`` does nothing. This change makes the external certificate get managed by Let's Encrypt by default when Let's Encrypt is enabled. The server address is default Let's Encrypt ACME server [1] which was the former default before change [2]. [1] https://acme-v02.api.letsencrypt.org/directory [2] https://review.opendev.org/c/openstack/kolla-ansible/+/925971 Closes-bug: #2120451 Change-Id: I10e800aede5966e030ed8e661e2eb45b126ff678 Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
2025-06-03Fix docs rendering errors.Michael Still2-20/+22
I was reading https://docs.openstack.org's version of the kolla-ansible advanced configuration guide and noticed some RST rendering errors. This patch corrects those errors so that the page renders correctly. Change-Id: I330678d8971d286e67f115eace1cb606d30433b6
2025-05-08Merge "Add container engine migration scenario"Zuul1-0/+38
2025-04-30Remove warning from password rotation docs pageAlex-Welsh1-7/+0
The Password rotation docs page had a warning that the guide relied on "recent changes" to Kolla Ansible. The changes have now existed for over a year, so the warning is not needed. Change-Id: I0706de976f5184a91977c11897524a6cd48d0b1c
2025-04-01Merge "Fix reference to generating a private CA"Zuul1-3/+3
2025-03-21Remove Swift roleMichal Nasiadka2-13/+4
Since Swift is broken and since deprecation nobody did pick up the work to make it working - let's remove swift role and associated integrations/CI scripts. Change-Id: I08e92aaeea644053fd25f80ce1f276a495cebbfc
2025-03-19Add container engine migration scenarioKonstantin Yarovoy1-0/+38
Add "migrate-container-engine" action to kolla-ansible which changes the container engine on which the Openstack is deployed on. For example Docker to Podman and vice versa. Depends-on: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/925083 Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Signed-off-by: Martin Hiner <m.hiner@partner.samsung.com> Signed-off-by: Roman Krček <roman.krcek@tietoevry.com> Change-Id: Icd709cb042d44e063c5da64ab0695b0b6ba6d48b
2025-01-22Fix reference to generating a private CAPierre Riteau1-3/+3
Also fix a typo while here. Change-Id: I65d058842fb1bdfccc41f5d7b5a175cdf4ef4969
2024-12-18Docs update - kolla-ansible cli parametersJakub Darmach3-9/+9
With rewrite of kolla-ansible CLI to Python in I9749b320d4f5eeec601a055b597dfa7d8fb97ce2 the order of parameters have to be: `kolla-ansible <action> <arguments>` Change-Id: I1bd4a7f96f77c34fb46ca21f37023dddf73e8f05 Closes-bug: 2087920
2024-11-25Fix TLS settings when letsencrypt turned onMichal Arbet1-0/+15
- Introduced `letsencrypt_managed_certs` variable to handle whether letsencrypt will generate internal, external or both certificates. - Updated certificate generation logic to use `letsencrypt_managed_certs` conditionally, replacing the previous `enable_letsencrypt` boolean. - Adjusted tasks and templates to support internal/external certificate management based on the new variable. - Enhanced Let's Encrypt script (`letsencrypt-lego-run.sh.j2`) to handle both internal and external certificates depending on VIP configurations. - Refined HAProxy configuration templates to correctly map certificates based on TLS settings and new management logic. Closes-bug: #2076331 Change-Id: Id80c7823fcc5d934b7369c7c0722cd78188e2ccf Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io>
2024-11-19Updates docs to fix incorrect container exampleAntony Messerli1-3/+3
Existing container was out of date and did not work for the db restore example. Updates to a rocky-9 example. Change-Id: I5f57467a18d3e42e0c71826cc3a7740110162af7
2024-08-30harden haproxy TLS configurationSven Kieske1-0/+26
harden the TLS default config according to the mozilla "modern" recommendation: https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=modern&openssl=1.1.1k&guideline=5.7 if you want to revert to the old settings, set: kolla_haproxy_ssl_settings: "legacy" in globals.yaml alternatively you can also set it to "intermediate" for a middle ground between security and accessibility. this also adjusts the glance and neutron tls proxy ssl settings in their dedicated haproxy config templates to use the same mechanism. also add some haproxy related docs to the TLS guide and cross reference it from the haproxy-guide. Closes-Bug: #2060787 Signed-off-by: Sven Kieske <kieske@osism.tech> Change-Id: I311c374b34f22c78cc5bcf91e5ce3924c62568b6
2024-07-09Fix prechecks for interfaces with dashesMichal Nasiadka1-6/+0
Closes-Bug: #2070051 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/923544 Change-Id: I221eb136e77c61aef39e8646b48b927352d1419d
2024-02-21Add password rotation docs pageAlex-Welsh2-0/+296
Closes-Bug: #1793323 Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/903178 Depends-On: https://review.opendev.org/c/openstack/kolla/+/902057 Change-Id: Ibebd6e04de215e1a1aaff52c55d28c4741af98f2
2023-11-29Update etcd docs and renoDr. Jens Harbott1-14/+17
Just some minor formatting and wording updates Change-Id: Ia42944512f8d14a1993bd4ae3d09f0f2ab431322
2023-11-28etcd: Add support for more scenariosJan Gutter2-0/+98
This commit addresses a few shortcomings in the etcd service: * Adding or removing etcd nodes required manual intervention. * The etcd service would have brief outages during upgrades or reconfigures because restarts weren't always serialised. This makes the etcd service follow a similar pattern to mariadb: * There is now a distiction between bootstrapping the cluster and adding / removing another member. * This more closely follows etcd's upstream bootstrapping guidelines. * The etcd role now serialises restarts internally so the kolla_serial pattern is no longer appropriate (or necessary). This does not remove the need for manual intervention in all failure modes: the documentation has been updated to address the most common issues. Note that there's repetition in the container specifications: this is somewhat deliberate. In a future cleanup, it's intended to reduce the duplication. Change-Id: I39829ba0c5894f8e549f9b83b416e6db4fafd96f
2023-11-07Add support for LetsEncrypt-managed certsJames Kirsch1-0/+29
Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106
2022-10-18Update RHEL family informationMarcin Juszkiewicz1-4/+4
Some time ago we dropped RHEL as one of possible options. During 'Zed' cycle we added Rocky Linux 9 as alternative to CentOS Stream 9. This change updates some mentions of both. Change-Id: I9ed93efcb7d1ff97b1c7d8342db8252aba2a9887
2022-07-27Remove the deprecated storage_interface varRadosław Piliszek1-6/+1
Change-Id: I63673761959a560e97c848f092f086ceba25839a
2022-05-31Merge "Improve MariaDB restore procedure"Zuul1-5/+19
2022-01-20Merge "Deprecate storage_interface variable"Zuul1-4/+5
2022-01-11Improve MariaDB restore procedurePiotr Parczewski1-5/+19
Change-Id: Id05122cb564f3e7475b2b76da8c111e2c72601b8
2022-01-03docs: adjust to current defaultsPiotr Parczewski1-3/+3
Change-Id: I2e6b6ecd3717ff0811b47892aad406376c89a18c
2021-12-23Deprecate storage_interface variableRadosław Piliszek1-4/+5
Per [1] and exchange on IRC. [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-December/026437.html Change-Id: I322500e7204eb129d7bf085006627e8c4aaaa934
2021-05-25Merge "docs: Add note about internal VIP when HAProxy is disabled"Zuul1-0/+3
2021-04-19docs: Improve policy documentationMark Goddard1-14/+21
Change-Id: Iede747ceaafa54a00186761943fe2f4ac13f9559
2021-03-26Merge "Add `kolla_externally_managed_cert` option"Zuul1-0/+12
2021-03-25docs: Add note about internal VIP when HAProxy is disabledMark Goddard1-0/+3
Change-Id: I08030ac88911d3594c75cb2184767067ad177139
2021-03-02Add `kolla_externally_managed_cert` optionArthur Outhenin-Chalandre1-0/+12
This option disables copy of certificates from the operator host to kolla-ansible managed hosts. This is especially useful if you already have some mechanisms to handle your certificates directly on your hosts. Co-Authored-By: Marc 'risson' Schmitt <marc.schmitt@risson.space> Change-Id: Ie18b2464cb5a65a88c4ac191a921b8074a14f504
2021-01-27[docs] Unify project's naming conventionPiotr Parczewski1-2/+2
There are inconsitencies across the documentation and the source code files when it comes to project's name (Kolla Ansible vs. Kolla-Ansible). This commit aims at unifying it so that the naming becomes consistent everywhere. Change-Id: I903b2e08f5458b1a1abc4af3abefe20b66c23a54
2020-12-22Fix api_adress_family typoVictor Morales1-1/+1
Change-Id: Id93e7a91253b46e42d4817785d42ccc52564c330
2020-10-12Add support for encrypting backend Neutron API ServerJames Kirsch2-2/+6
Add TLS support for backend Neutron API Server communication using HAProxy to perform TLS termination. When used in conjunction with enabling TLS for service API endpoints, network communication will be encrypted end to end, from client through HAProxy to the Neutron service. Change-Id: Ib333a1f1bd12491df72a9e52d961161210e2d330 Partially-Implements: blueprint add-ssl-internal-network
2020-10-07Merge "Add support for ACME http-01 challenge"Zuul3-0/+45
2020-09-26Add support for ACME http-01 challengeRadosław Piliszek3-0/+45
All docs are included. Change-Id: Ie29ff7ca340812c8dc0dac493518c87cf7bf137b Partially-Implements: blueprint letsencrypt-https
2020-09-17Support TLS encryption of RabbitMQ client-server trafficMark Goddard1-0/+2
This change adds support for encryption of communication between OpenStack services and RabbitMQ. Server certificates are supported, but currently client certificates are not. The kolla-ansible certificates command has been updated to support generating certificates for RabbitMQ for development and testing. RabbitMQ TLS is enabled in the all-in-one source CI jobs, or when The Zuul 'tls_enabled' variable is true. Change-Id: I4f1d04150fb2b5af085b762890092f87ae6076b5 Implements: blueprint message-queue-ssl-support
2020-08-20remove obsolete configurationswu.chunyang1-9/+3
remove cluster_interface from project. update storage_interface docs.and remove storage_interface_address variable Change-Id: I3f811db988234f94b5ed0cc9d24233f70784f58d
2020-08-04Update TLS documentationJames Kirsch1-84/+277
Updated TLS documentation to reflect new features and configuration options added in Ussuri. Change-Id: I74550eaf394287b14fc521293cc4b5ea8074192c Partially-Implements: blueprint add-ssl-internal-network
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 19:50:03 +0000