aboutsummaryrefslogtreecommitdiff
path: root/kolla_ansible/cmd
AgeCommit message (Collapse)AuthorFilesLines
2026-04-24Merge "Fix shebangs"Zuul2-2/+2
2026-01-16kolla-ansible: migrate redis password to valkey in mergepwdPiotr Milewski1-0/+10
When migrating from Redis to Valkey, 'valkey_master_password' is introduced as a new requirement. During an upgrade, 'kolla-mergepwd' previously left the newly generated random password for Valkey, ignoring the existing Redis password. This caused critical authentication failures. Specifically, for users utilizing custom Keystone caching solutions, starting Valkey with a new password would seriously damage the entire cluster. Furthermore, in standard upgrades, Octavia stops working due to the password change, leaving the service unstable until the upgrade is complete. This patch updates 'mergepwd.py' to detect when 'valkey_master_password' is a new entry and automatically assigns it the value of the existing 'redis_master_password'. This ensures a seamless transition and maintains cloud stability during the Redis-to-Valkey migration. Closes-Bug: #2138461 Change-Id: Id0eb88e739c44016a0bd118793f81ff66a624655 Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2025-06-03Fix shebangsDinçer Çelik2-2/+2
Change-Id: I305bb756eb2fd8f582bbef5b2674f8b09b141ab8
2024-10-28Rewrite kolla-ansible CLI to pythonRoman Krček1-0/+50
Moving the CLI to python allows for easier maintenance and larger feature-set. This patch introduces a few breaking changes! The changes stem the nature of the cliff package. - the order of parameters must be kolla-ansible <action> <arguments> - mariadb_backup and mariadb_recovery now are mariadb-backup and mariadb-recovery Closes-bug: #1589020 Signed-off-by: Roman Krček <roman.krcek@tietoevry.com> Change-Id: I9749b320d4f5eeec601a055b597dfa7d8fb97ce2
2023-11-07Support exposing prometheus_server externallyWill Szumski1-2/+11
This avoids the need to use a proxy, or some other means, to connect to Prometheus. This is disabled by default and can be enabled by setting enable_prometheus_server_external to true. Change-Id: Ia0af044ff436c2a204b357750a16ff49fcdfec45
2023-11-07Add support for LetsEncrypt-managed certsJames Kirsch1-2/+3
Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106
2023-05-31Fix passwords.yml permissionsMaksim Malchuk4-3/+69
The kolla-genpwd, kolla-mergepwd, kolla-readpwd and kolla-writepwd commands now creates or updates passwords.yml with correct permissions. Also they display warning message about incorrect permissions. Closes-Bug: #2018338 Change-Id: I4b50053ced9150499d1d09fd4a0ec2e243cf938b Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
2022-05-24genpwd: handle lack of password file nicerMarcin Juszkiewicz1-2/+6
From: (kolla) 13:11 (s) marcin@puchatek:kolla-ansible$ kolla-genpwd Traceback (most recent call last): File "/home/marcin/.virtualenvs/kolla/bin/kolla-genpwd", line 8, in <module> sys.exit(main()) File "/home/marcin/.virtualenvs/kolla/lib/python3.10/site-packages/kolla_ansible/cmd/genpwd.py", line 135, in main genpwd(passwords_file, length, uuid_keys, ssh_keys, blank_keys, File "/home/marcin/.virtualenvs/kolla/lib/python3.10/site-packages/kolla_ansible/cmd/genpwd.py", line 59, in genpwd with open(passwords_file, 'r') as f: FileNotFoundError: [Errno 2] No such file or directory: '/etc/kolla/passwords.yml' To: (kolla) 13:17 (s) marcin@puchatek:kolla-ansible$ kolla-genpwd ERROR: Passwords file "/etc/kolla/passwords.yml" is missing Change-Id: I18a9559daeb3d124a03dcb735ebb01a2cf24f617
2022-03-30neutron: add ssh keyMichal Nasiadka1-1/+2
This key can be used by users in networking-generic-switch scenario instead of adding cleartext password in ml2_conf.ini. Change-Id: I10003e6526a55a97f22678ab81c411e4645c5157
2021-06-30Support storing passwords in Hashicorp VaultScott Solkhon2-0/+238
This commit adds two new cli commands to allow an operator to read and write passwords into a configured Hashicorp Vault KV. Change-Id: Icf0eaf7544fcbdf7b83f697cc711446f47118a4d
2020-12-22Remove Retired Karbor SupportKendall Nelson1-2/+1
As announced on the openstack-discuss ML[1], Karbor is retiring this cycle (Wallaby). Needed-By: https://review.opendev.org/c/openstack/karbor/+/767032 [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-November/018643.html Change-Id: I222cf302e507f6a9de0347c79ec536aa7be22bb6
2020-10-02Implement automatic deploy of octaviawu.chunyang1-1/+1
this patchset has implemented: - network (lb-mgmt-net) - security groups and rules (used by amphora and health manager) - amphora flavor (used by amphora) - nova keypair (used by amphora at the time of debugging) Add a octavia_amp_listen_port variable which used by amphora Add amp_image_owner_id in octavia.conf Implements: blueprint implement-automatic-deploy-of-octavia Co-Authored-By: zhangchun <zhangchun@yovole.com> Depends-On: https://review.opendev.org/652030 Change-Id: I67009d046925cfc02c1e0073c80085c1471975f6
2020-05-22Improve error reporting in password utilitiesMark Goddard2-0/+13
The kolla-genpwd and kolla-mergepwd commands can be used to manipulate the kolla passwords.yml file. The format is a YAML encoded dict of password variable names to their values. If the format is not a dict, the error messages are unhelpful. In particular, this can happen if the file is encrypted e.g. via Ansible Vault. For kolla-genpwd: AttributeError: 'NoneType' object has no attribute 'items' For kolla-mergepwd: AttributeError: 'NoneType' object has no attribute 'update' This change adds a more friendly message. Change-Id: I27f0835b904e05006ae401adf383090322e1b891 Closes-Bug: #1880220
2020-05-17Enable W503 for flake8 checkgugug1-3/+3
W503 and W504 are incompatible and we need to choose one of them. Existing codes follows W503, so we disable W504. Change-Id: Ic745e956dd332eb0fa49b93c1e6acb12f8a7f26c
2020-02-13Merge "Remove kolla-ceph"Zuul1-2/+1
2020-02-11Remove kolla-cephMichal Nasiadka1-2/+1
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1]. This change removes the Ansible code and associated CI jobs. [1]: https://review.opendev.org/669214 Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
2020-02-08Add --clean to kolla-mergepwdRadosław Piliszek1-3/+13
to clean old keys on merge. Change-Id: Ifcc99e7c737707eea9e951db066dc94fd85bd9f7
2019-10-15Fix Python3 compatibility for kolla-genpwdIonut Balutoiu1-1/+1
The method `Fernet.generate_key()` generates a binary string in Python 3: ``` >>> Fernet.generate_key() b'qSMZlOK23pZUw_Uyy-ZRPUfPskMXKGCGmhG6AHCFiV8=' ``` Unless properly written as a string to the Kolla `passwords.yml` file, the Fernet key will end up in the final Barbican config like this: ``` [simple_crypto_plugin] kek = b'qSMZlOK23pZUw_Uyy-ZRPUfPskMXKGCGmhG6AHCFiV8=' ``` Due to the fact that the key is incorrectly written to the barbican config file (it should be written as a string), every barbican secret store fails with: ``` barbican.api.controllers File "/var/lib/kolla/venv/lib/python3.6/site-packages/barbican/plugin/store_crypto.py", line 83, in store_secret barbican.api.controllers encrypting_plugin, context.project_model) barbican.api.controllers File "/var/lib/kolla/venv/lib/python3.6/site-packages/barbican/plugin/store_crypto.py", line 290, in _find_or_create_kek_objects barbican.api.controllers kek_meta_dto = plugin_inst.bind_kek_metadata(kek_meta_dto) barbican.api.controllers File "/var/lib/kolla/venv/lib/python3.6/site-packages/barbican/plugin/crypto/simple_crypto.py", line 104, in bind_kek_metadata barbican.api.controllers encryptor = fernet.Fernet(self.master_kek) barbican.api.controllers File "/var/lib/kolla/venv/lib/python3.6/site-packages/cryptography/fernet.py", line 38, in __init__ barbican.api.controllers "Fernet key must be 32 url-safe base64-encoded bytes." barbican.api.controllers ValueError: Fernet key must be 32 url-safe base64-encoded bytes. ``` This commit fixes the issue described above by properly writing the Fernet key as a string to the Kolla `passwords.yml` file. Closes-Bug: #1848191 Change-Id: I27fc0159c889bc2e1576fdd69b7d02a320b620f8
2019-03-10cmd: Extract methods to allow import from externalMaciej Kucia2-43/+53
When methods for passwords generation and merge are extracted then external apps and scripts can use those methods without resolving to subprocess execution or injecting sys.argv. Change-Id: I99aff7852180534129fa36859075306eea776ba9 Signed-off-by: Maciej Kucia <maciej@kucia.net>
2018-07-26Use fernet for barbican crypto keyEduardo Gonzalez1-7/+5
Sha password is not always valid for barbican cripto key. Use a fernet key so it always gets valid. Not need release note for upgrade, users with a working barbican not regenerate passwords, only new passwords will get new type. Change-Id: Ic8c4ca63219295d697062cff9cbf30fadbe49bf3
2018-05-22Updated genpwd to work with python35Borne Mace1-6/+6
Due to the changes in hmac.new and how binary strings are dumped in yaml.safe_dump some changes were needed to make sure that we dumped only strings, not binary strings. Change-Id: Ic2fbcf2347023c1e9e666203dfe40dbeaf24ce5f
2017-09-14Add missing dot to help string in genpwd.py scriptChristian Berendt1-1/+1
Change-Id: I87df49939f600cfa1041193808ce6bdcf4620ffc
2017-06-19Merge "Use cryptography instead of pycrypto"Jenkins1-4/+17
2017-06-02Support OSprofile usageEduardo Gonzalez1-1/+2
OSprofile allows user/devs trace OpenStack requests. Implements: blueprint enable-osprofiler Co-Authored-By: Bertrand Lallau <bertrand.lallau@gmail.com> Change-Id: I82ea85d726011ef6cbf99380f395452d6d7f8053
2017-04-24Use cryptography instead of pycryptoRui Yuan Dou1-4/+17
pycrypto is no longer maintained [1]. This patch rewrites functions using pycrypto and replaces them with the cryptography equivalent [1] http://lists.openstack.org/pipermail/openstack-dev/2017-March/113568.html Change-Id: I375b5876ec2f4c4f32b9f6b3f41d209a59a0f615
2017-03-30Use yaml.safe_dump() instead of yaml.dump()zhuzeyu2-2/+2
Remove Python specific types from YAML output Produce only basic YAML tags Change-Id: Ib6a4c18663897efb7243ed1ff84df1c9f2abf8bf
2017-03-22Fix can't find /usr/lib/libCryptoki2_64.so in barbicanzhubingbing1-0/+8
Link https://docs.openstack.org/project-install-guide/key-manager/newton/barbican-backend.html#simple-crypto-plugin Change-Id: I351738c2a98090c56ac69e477fbe5ddec4cc5b26 Closes-Bug: #1672001
2017-03-08Fix booting from volume failureJeffrey Zhang1-3/+7
Booting from volume require cinder's ceph client secret now. Move cinder before nova in site.yml, because nova depends on cinder ceph client key now. Change-Id: I01c9ed80843d98305b8963894c4917c21a35d3ac Closes-Bug: #1670676
2017-02-15Rename kolla namespace to kolla_ansibleJeffrey Zhang3-0/+145
* Rename kolla namespace to kolla_ansible * remove oslo.config.opts entry points which is uesless * delete useless tools/version-check.py script Change-Id: I005dd7223ff23afbb2ce8cbfd0ebec0969102798
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 16:05:37 +0000