| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
This reference was missed during the removal of the Linux bridge
mechanism driver [1].
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/962278
Change-Id: Iff92e75a594a4888cf4cd179d7ac5de46e5c7f09
Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
(cherry picked from commit bf02dd405a084ffd680bc5a835b8ab48e76485f6)
|
|
Since Grafana 13.2, the api/user/helpflags/1 endpoint has been removed
[1]. This means the "Disable Getting Started panel" deployment task
fails with 404 when a custom home dashboard is added.
The best alternative I can find is to set default_home_dashboard_path in
grafana.ini, which disables the panel anyway [2]
[1] https://github.com/grafana/grafana/pull/124916
[2] https://github.com/grafana/grafana/pull/28750
Change-Id: I78b8657b6ca94d81e3becbba9d5a476d9427658f
Signed-off-by: Alex Welsh <alex@stackhpc.com>
Closes-Bug: #2166048
(cherry picked from commit c8e7b85b2707f762b2560ad8bed9d107a30ff521)
|
|
From the experience we have made so far, a lot of AI based contributions
tend to cause more work rather than they bring benefit. So we caution
people to avoid this when possible.
The wording of the policy was adapted from the Zuul project [0].
[0] https://review.opendev.org/c/zuul/zuul/+/993998
Co-Authored-By: James E. Blair <jim@acmegating.com>
Signed-off-by: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I5fcd5bea33c4f4c87b6f6cf0a96514e8d2da3af3
(cherry picked from commit c202c27ba62bd599a1f9d6fcb07cce5234e33361)
|
|
The libvirt daemon ships with max_workers=20 and max_client_requests=5.
Those defaults suit a multi-tenant host serving many mutually
distrustful clients, where the per-client request cap protects the
daemon from any single client monopolising it. Under Kolla-Ansible,
nova-compute is effectively the sole privileged client of libvirtd, so
the cap of 5 concurrent requests per client becomes the binding
constraint rather than a safety net.
When several instances build at once -- as they do during the tempest
run of the upgrade jobs -- nova-compute's concurrent libvirt RPCs
(instance defineXML calls plus the resource-tracker periodic) exceed
five. Further requests queue, the connection's keepalive responses are
starved, and after keepalive_interval (5s) x keepalive_count (5) = 25s
libvirtd closes the connection. nova then sees "Cannot recv data:
Input/output error" mid-defineXML, the build is rescheduled, and once
all hosts are exhausted the instance is left in ERROR. This presents as
flaky upgrade-job failures.
Example failure, on the voting kolla-ansible-debian-bookworm-upgrade
job (stable/2025.2):
https://zuul.opendev.org/t/openstack/build/73ff5a97567d4e05b1774170e0f4aada
with primary/logs/kolla/libvirt/libvirtd.txt showing libvirt's own
recommendation to tune this parameter:
warning : Client hit max requests limit 5. This may result in
keep-alive timeouts. Consider tuning the max_client_requests server
parameter
...
error : connection closed due to keepalive timeout
Raise the per-client cap to 20 -- comfortably above the handful of
concurrent builds plus periodics seen in practice -- and the worker
pool to 50 so that lifting the per-client limit does not starve other
connections such as live migration, health checks and periodic tasks.
Both values are exposed as variables (libvirt_max_client_requests and
libvirt_max_workers) so operators can tune them further.
This is not a Kolla-specific workaround -- the stock libvirtd.conf
comment warns that setting max_client_requests too low "may cause
keepalive timeouts", and since 2022 libvirtd emits the runtime warning
quoted above. As Daniel Berrange explained when he added that warning,
the keepalive packets "are subject to the 'max_client_requests' limit
just like any API calls", so a client that saturates the limit can have
its connection dropped:
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/5NIJPA7SJVY55VSK7RTEDEHKWOZYJKT6/
Red Hat documents the same tuning for libvirt hosts under load in its
knowledge base, notably "Too many active clients are dropping the
connection" at https://access.redhat.com/solutions/28146.
Assisted-By: Claude Opus 4.8 (1M context, medium effort)
Partial-Bug: 2158515
Change-Id: I131c3d4d57dc73ca4dd421cc8f28465248c9830e
(cherry picked from commit 5acd2f91d22213ef04bd6988a2a0261982b0cf05)
Signed-off-by: Michael Still <mikal@stillhq.com>
|
|
Keeping this value to true with external RGW as object storage endpoints
can cause outages that are annoying to recover from. We should warn
operators about this.
Change-Id: I37965382bed6b9762782ec3f9ec3103143d738cc
Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com>
(cherry picked from commit 8510b763fec5fbfdcd677177809c682eb69e97dc)
|
|
|
|
|
|
Previously, operators had to manually create the default index
pattern after the first login to OpenSearch Dashboards.
This commit automates the creation of the default index pattern
using the OpenSearch Dashboards Saved Objects API during the
post-config phase. The pattern is dynamically named based on the
opensearch_log_index_prefix variable (defaulting to "flog-*")
and automatically sets "@timestamp" as the time field.
Documentation has been updated to reflect that the first-login
manual setup is no longer required for the default log indices.
Change-Id: I8d49a270ace187b3b13103452e93d305505f6cbb
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
|
|
|
|
Zun is broken in 2026.1, it has been released broken and there are
no reviews on the patch to fix it [1].
[1]: https://review.opendev.org/c/openstack/zun/+/982362
Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/986150
Change-Id: I8ced621754d03c44b7672dd94fc3d7d2173ac734
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
Adds support for deploying multiple instances of the Nova
Compute Ironic service on the same host. This is useful
in large baremetal deployments, where the sharding and/or
conductor group feature is used to scale out the service.
A further patch to support deploying multiple Ironic
conductor instances will follow.
Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com>
Co-Authored-By: Bertrand Lanson <bertrand.lanson@protonmail.com>
Change-Id: Ibbddfd87e831a3775c3ed66c80b18e5070cedc90
Signed-off-by: Doug Szumski <doug@stackhpc.com>
|
|
When fanout queues are set to be RabbitMQ stream, number of ready
messages in stream queues grow large.
This is because retention policy of stream is only applied when stream
segments hit the maximum size.
This change make the maximum size of RabbitMQ stream segment and the
retention time configurable by new variables
``rabbitmq_stream_max_segment_size_bytes`` and
``rabbitmq_stream_segment_max_age`` respectively.
NOTE: These are only applied when ``om_enable_rabbitmq_stream_fanout``
is set to ``true``.
Change-Id: Iade5e525f0de8981a0e03e3340ad7552c2f40121
Signed-off-by: Seunghun Lee <seunghun@stackhpc.com>
|
|
|
|
|
|
Kolla-Ansible defaulted for long time to deploy cinder-volume/backup
containers on storage group, which is good for Cinder LVM deployments.
Problem is - majority of deployments does not use Cinder LVM
backend - they use mainly Ceph (based on OpenStack User Survey)
and probably some other proprietary vendors which are API driven.
Let's change the default to reflect reality.
If a user has cinder lvm enabled - we will deploy it as it was before
If a user has both cinder lvm and something else enabled - we will deploy
cinder-volume and cinder-backup in both places (cinder group and storage group)
If a user doesn't have cinder lvm enabled - we deploy only in the cinder group
Change-Id: Ia4a874de8f1b8eab8ff688eab4c6af013449c18c
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
This patch implements vpnaas for OVN environments. It deploys
a standalone neutron-ovn-vpn-agent on neutron nodes.
The container no longer requires 'privileged: true'. Running
as the 'neutron' user with specific kernel capabilities ensures
the agent can manage network namespaces and interfaces without
full privileges.
Added capabilities:
- NET_ADMIN # manage interfaces, IPs, routing, firewall
- SYS_ADMIN # create/manage network namespaces
- SYS_PTRACE # allow 'ip netns exec' attach to processes
- DAC_OVERRIDE # bypass file read/write restrictions
- DAC_READ_SEARCH # allow directory traversal and file read
- SETPCAP # retain capabilities for privileged ops
Added security options:
- apparmor=unconfined # disable AppArmor confinement
- seccomp=unconfined # disable seccomp filtering
- label=disable # disable SELinux/labeling
Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302
Closes-Bug: #2048392
Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5
Signed-off-by: Joachim de Groot <joachim.de.groot@menzel-it.net>
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
|
|
1. Add CI coverage for keystone_identity_providers under federation
scenario.
2. Add fix for federation config in keystone role if keystone_identity_providers is
defined.
3. Update Horizon tests with federation example.
4. Use openstack.cloud ansible modules instead of python-openstackclient
in register_identity_providers.yml
Closes-Bug: #2134455
Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859
Signed-off-by: Taavi Ansper <taaviansperr@gmail.com>
|
|
Basically Ansible heuristic obfuscation methods mark auth:
that we pass to openstack.* modules as no_log_values and then
obfuscates it's values in other runs (which then end up as ****
e.g. auth_url, domain_id, domain name, etc)
Example return:
"domains": [
{
"description": "The ******** domain",
"id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
"is_enabled": true,
"links": {
"self": "********/v3/domains/********"
},
"name": "Default",
"options": {},
"tags": []
}
This patch adds clouds.yaml to files templated for kolla-toolbox
(but without the password) and only uses password from Kolla-Ansible
secrets instead of storing that on disk on all of the nodes.
Change-Id: I479445563d5b5dc2e45601e936d89def647da841
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1].
Remove it from our documentation. SSO with Keycloak was successfully
tested without it.
Keep documentation about keystone_federation_oidc_additional_options by
using OIDCOutgoingProxy instead.
[1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0
Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a
Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
|
|
Recent changes to OpenStack Compute have added a number of new
configuration options for SPICE VDI consoles. Additionally, it is
not always desirable to enable the HTML5 transcoding proxy for
SPICE consoles in Horizon. This patch adds configuration to
globals.yml for most of these new options. Specifically:
* nova_spice_html5: whether to enable the HTML5 transcoding proxy
or not. Defaults to the previous behaviour of enabling the proxy.
Notably, nova_spice_require_secure is not exposed here as it implies
that qemu is configured to support TLS, and that TLS certificates
have been configured in the nova_libvirt container. These changes
are large, and are included in a separate patch for clarity.
Additionally, OpenStack Compute added these configuration options
in 2023.1, and they are exposed as well:
* nova_spice_image_compression: "auto_glz"
* nova_spice_jpeg_compression: "auto"
* nova_spice_zlib_compression: "auto"
* nova_spice_playback_compression: true
* nova_spice_streaming_mode: "filter"
All configuration options and their various values are documented
by OpenStack Compute in their documentation.
Partial-Bug: #2131793 (spice-direct consoles)
Change-Id: I07f6890f1c7c4e543667d3cbd7b3e82bd9ec83e3
Signed-off-by: Michael Still <mikal@stillhq.com>
|
|
|
|
This patch adds the ability for operators to provide a custom
wsrep-notify.sh script to handle Galera cluster events (e.g., node
status changes, membership updates).
If a script is placed in the custom configuration directory on the
control host (/etc/kolla/config/mariadb/wsrep-notify.sh), Kolla
Ansible will copy it to the nodes, mount it into the MariaDB
container at /usr/local/bin/ and enable 'wsrep_notify_cmd'.
This enables integration with external systems like Alertmanager
or local logging without hardcoding scripts into the roles.
Change-Id: I7887889cb2e4038baeb566884cb847a71b5f99a6
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
The RabbitMQ version check currently hardcodes allowed version jumps.
This makes supporting new major/minor releases (like 4.2) rigid and
requires modifying the core task file.
This commit introduces the `rabbitmq_allowed_upgrades` variable in
the role's defaults. This allows operators to define explicit version
jumps (e.g., 3.13 to 4.2) and makes the upgrade logic more flexible.
The version validation logic now:
1. Checks for standard minor increments (e.g., 4.1 -> 4.2).
2. Checks for explicitly defined jumps in `rabbitmq_allowed_upgrades`.
By moving these definitions to defaults, operators can easily override
them in globals.yml if necessary.
Depends-On: https://review.opendev.org/c/openstack/kolla/+/966017
Change-Id: I0e19cf109eb5665045806b7d925779e82164c2dc
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
|
|
|
|
|
|
Closes-Bug: #2102239
Change-Id: Ia8e551c62fc5d2d775098026d5d85611b81934fc
Signed-off-by: Rafal Lewandowski <rafal@stackhpc.com>
|
|
|
|
|
|
This patch moves the default Ironic kernel parameters
from templates into variables located in the 'Kernel
Parameters' section. Existing configurations are supported
using existing variables. Default NTP configuration for
the Ironic Python Agent (IPA) was also added in this patch.
Change-Id: I2ef63233eae661ed056bfa215b2875f44e0b6134
Signed-off-by: Doug Szumski <doug@stackhpc.com>
|
|
|
|
This commit adds the ability to enable and configure LDAP
authentication for Grafana. It introduces a new variable
'grafana_ldap_enabled' and automates the process of copying the
'ldap.toml' configuration file and updating 'grafana.ini'.
Change-Id: I1f9de8202629904757840f5b2b5d0b8429e42f96
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
Adds the ovn_northd_cmdline_extras variable to allow operators to pass
additional command-line arguments to the ovn-northd daemon. This enables
customization of performance-related parameters such as thread count
(--n-threads), parallel build (--use-parallel-build), and inactivity
probe timeout (--inactivity-probe).
The implementation follows the established cmdline_extras pattern used
throughout kolla-ansible for services like Prometheus exporters.
Closes-Bug: #2142316
Change-Id: I870034da10f80ff2208bbad529fa7de9a2548c06
Signed-off-by: Antony Messerli <antony@mes.ser.li>
|
|
Closes-Bug: #2138290
Change-Id: Ic5fc1b7e801b28a2bb20b4a60146ac443ffe5ef0
Signed-off-by: Matt Crees <mattc@stackhpc.com>
|
|
|
|
|
|
Kolla delivers InfluxDB v1, which is EOL (unless you have paid support).
There are no plans in upgrading InfluxDB to v2 - so let's drop it.
Telegraf was deprecated in June 2025.
Removing both in one patch for convenience.
Change-Id: Ieee2be3a06a5ac9504a822cc0a727e662146b260
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
|
|
pcre3 was removed from recent debian-based releases (eg. Trixie[1]),
while RHEL10/CentOS Stream 10 no longer ships pcre in favor of pcre2.
Use the latest whereto library release (0.5.0) which uses pcre2
instead.
[1] https://lists.debian.org/debian-devel/2021/11/msg00176.html
Depends-on: https://review.opendev.org/c/openstack/requirements/+/97142
Change-Id: I3defc6a343f5a211b0e7185017085371631b3dee
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
|
|
This is for the same reason as an earlier fix to the mariadb role [1].
[1] https://review.opendev.org/c/openstack/kolla-ansible/+/970265
Change-Id: Ib8c0e02866245ff1d35ccf6a0d3121d8eb9a4e48
Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
|
|
|
|
Closes-Bug: #2120302
Change-Id: Ideb7974796ba503a2ac979a321b9c6f27c7c22a1
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
|
|
Add missing 'in' in the sentence linking to Virtual Environments:
"This is covered Virtual Environments." ->
"This is covered in Virtual Environments."
Closes-Bug: #2128781
Change-Id: If81d251ff2a73d3d360b8863f98a5c334a876b45
Signed-off-by: amir58118 <sahahmadi96@gmail.com>
|
|
This commit addresses and corrects the inconsistency in naming
across multiple files within the project. Specifically, the terms
mariadb_recovery and mariadb_backup have been replaced with
mariadb-recovery and mariadb-backup respectively to adhere to the
project's naming conventions and improve clarity.
Change-Id: I47b80eaa0dc0487f506b47ca065951b5140e0d62
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
|
|
wait_discover_computes.yml had to be updated to pass ansible-lint
checks for undefined variables (ansible_facts.hostname/nodename was
rendered as UndefinedMarker type)
Change-Id: Iaded12e9bcf7ed558b7e35ea526ef1355cbca61a
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
|
|
|
